Configuring AD credentials for vSAN 8.0 File Services fails with "Unknown" Error

Products

• VMware vSAN
• VMware vSAN 8.x

Issue/Introduction

• On editing vSAN File Services configuration to add AD credentials, vSAN File Services VMs are created and join the domain. 
  
  
• However, the configuration task fails with error:

“Cannot complete the operation. See the event log for details. File server creation failed due to unknown reason. Contact VMware Support for more information”

Environment

VMware vSAN 8.x.

Cause

This can arise if there are multiple AD servers in the domain. The specific AD server selected (by algorithm) to set the Service Principal Name (SPN) is not accessible to the File Services VM container.

Typical logging:

ESXi /scratch/log/vdfs_support/containers/fsvm_logs/journal reports

1) The FS VM joins the domain:
photon-############ vsfs-###########[1629]: [MainThread] Changing container state: container_init_succeeded

2) Setting SPN times out: 
photon--############ vsfs-###########[1629]: [MainThread] cmd_with_retries: [1/3] net ads keytab add_update_ads nfs/###########.##########.######.###
photon--############ vsfs-###########[1629]: [MainThread] cmd: (timeout=120) net ads keytab add_update_ads nfs/###########.##########.######.### --debuglevel 10 --timeout 120 --request-timeout 120 -U '###########'
photon--############ vsfs-###########[1629]: [MainThread] get_dc_list: returning 10 ip addresses in an ordered list
photon--############ vsfs-###########[1629]: [MainThread] get_dc_list: <IP list>

photon--############ vsfs-###########[1629]: [MainThread] cmd: Timeout running 'net ads keytab add_update_ads nfs/###########.##########.######.### --debuglevel 10 --timeout 120 --request-timeout 120 -U '###########***'' in 120 seconds
photon--############ vsfs-###########[1629]: [MainThread] Changing container state: domain_join_succeeded -> set_spn_timeout
photon--############ vsfs-###########[1629]: [MainThread] cmd: Timeout running 'net ads leave --debuglevel 10 --timeout 120 --request-timeout 120 -U '###########' in 120 seconds

Resolution

Specify a "Prefered AD server" accessible to the FS VM container network, when configuring AD credentials.