ESX AD Join Fails After Disabling RC4 and SMBv2

Products

• VMware vSphere ESXi

Issue/Introduction

• While trying to join ESX 9.x hosts to AD domain, it fails with error “The host failed to join the domain Domain name: Errors in Active Directory operations.“

Environment

 

• VMware ESX: 9.0.x

• Active Directory: Hardened environments where RC4 Kerberos encryption and SMBv1/v2 protocols are disabled.

 

 

Cause

By default, the authentication service used by ESXi (Likewise/lsass) may attempt to use legacy encryption types (RC4_HMAC) or older SMB dialects to communicate with Domain Controllers.
If the Domain Controllers are configured to only allow AES encryption (AES128/256) and SMBv3, the authentication handshake will fail even if the credentials are correct.

Resolution

Configure AD and join the ESXi host with RC4 and SMB v2.0 enabled
Once ESXi has finished joining the domain, disable RC4 and SMB v2.0 on the Active Directory side

Additional Information

Logging in to the ESXi host with an Active Directory account fails with the error "Cannot complete login due to an incorrect user name or password."