Removing stale vCenter Server registrations from Enhanced Linked Mode after nodes are removed - vCenter 8.0

Products

• VMware vCenter Server

Issue/Introduction

When a vCenter Server node is deleted or decommissioned from an Enhanced Linked Mode (ELM) environment without being gracefully unjoined, the remaining nodes retain stale entries in the VMware Directory Service (vmdir).
This prevents the successful integration of replacement vCenter instances.

Symptoms include:

• Removed vCenter Server still appears in the vSphere Client inventory.

• Replication errors in /var/log/vmware/vmdir/vmdir.log.

• Failure when attempting to repoint or join a new vCenter to the existing SSO domain.

Environment

vCenter Server 8.x

Cause

Stale Single Sign-On (SSO) metadata.
The legacy vCenter Server object remains in the vmdir replication topology because the cmsso-util unregister process was not completed prior to the node's removal.

Resolution

To remove stale metadata from a vCenter instance. :

1. Power down all vCenters and take offline snapshots before executing any commands. 

2. Log into the affected vCenter Server via SSH and run the following command to validate the stale node is present. :
   /usr/lib/vmware-vmdir/bin/vdcrepadmin -f showservers -h localhost -u administrator

3. Execute the unregister command on the Production vCenter, targeting the PNID (FQDN or IP) of the legacy vCenter:
   cmsso-util unregister --node-pnid <OLD_VC_FQDN> --username administrator@<SSO_domain>

4. Re-run the command from Step 2 to confirm the legacy node is no longer listed.

If the cmsso utility fails to remove the stale replication partner, utilize the jxplore utility to unregister the legacy node:

1. Download and install JXplorer from https://jxplorer.org/downloads/.
   Java must be installed for JXplorer to function properly.

2. Open the JXplorer utility.

3. Click File > Connect and enter the following information:

   • Host:
     <vCenter FQDN or IP Address>

   • Protocol:
     LDAPv3

   • Port:
     389 if using LDAP.
     636 if using LDAPS.

   • Base DN:
     dc=vsphere,dc=local

   • Level:
     User + Password for LDAP.
     SSL + User + Password  if using LDAPS.

   • User DN:
     cn=Administrator,cn=Users,dc=vsphere,dc=local
     Note: vsphere.local is the default naming convention for the SSO domain. If the environment has an SSO domain different to vsphere.local, replace as appropriate.

4. Once connected go to > Configuration >Sites > Lookupservice> Servers > vCenter Name >Replication Agreements > Right click and remove the stale agreement.
   
   

5. Restart vCenter services once removed:
   service-control --stop --all && service-control --start --all

6. Run the following command to validate the correction:
   /usr/lib/vmware-vmdir/bin/vdcrepadmin -f showservers -h localhost -u administrator

Additional Information

For more details on managing ELM topologies, refer to the Broadcom TechDocs:

• Repoint a vCenter Server Node to a New Domain