ESXi host silently disconnects from vCenter due to lwsmd memory exhaustion and Kerberos loop

Products

• VMware vSphere ESXi

Issue/Introduction

• An ESXi host joined to Active Directory (AD) shows as "Disconnected" in vCenter Server, and all resident Virtual Machines appear in an "Invalid" or "Unknown" state. Management agents (hostd, vpxa) become unresponsive.
• hostd service fails to respond to commands.
• The following error appears in /var/log/vmkernel.log: WARNING: World: 2706: Could not allocate new world handle for world ID: <ID>: Admission check failed for memory resource
• The following errors repeat in /var/log/syslog.log:

[lsass] Failed to run provider specific request (request code = 14, provider = 'lsa-activedirectory-provider') -> error = 40022, symbol = LW_ERROR_PASSWORD_MISMATCH

[LwKrb5GetTgtImpl ../lwadvapi/threaded/krbtgt.c:262] KRB5 Error code: -1765328360 (Message: Preauthentication failed)

Environment

• VMware ESXi 7.0.x
• VMware ESXi 8.0.x

Cause

A memory leak in the lwsmd (Likewise Service Manager) process occurs when a service account or machine account credential mismatch triggers an infinite Kerberos authentication loop. This loop exhausts the system memory heap, preventing the system from spawning new process threads required for management agents.

Resolution

This issue is fixed in VMware ESXi 8.0 Update 3h and higher. See Download Broadcom products and software to download this release.

For environments where an upgrade is not immediately possible, follow these steps:

1. Log in to the ESXi Shell or DCUI and restart the management agents to reclaim memory. Refer to Restarting Management Agents in ESXi
2. Review /var/run/log/syslog.log to identify the specific Active Directory account causing the LW_ERROR_PASSWORD_MISMATCH
3. Update the password for the identified account in Active Directory or ensure the ESXi machine account is not expired.
4. If the error persists, remove the host from the AD domain and rejoin it:
   1. Navigate to Host > Manage > Authentication.
   2. Click Leave Domain.
   3. Click Join Domain and provide valid administrative credentials.

Additional Information

ESXi host not responding or disconnected - VMware vSphere