vCenter Upgrade Fails with error "vCenter upgrade failed at stage PREPARATION" due to Missing vsphere-ui Service Account in SDDC Manager

Products

• VMware Cloud Foundation

Issue/Introduction

• Running the upgrade via SDDC Manager it fails on the 'VCENTER UPGRADE PREPARATION' stage 
• Reviewing the /var/log/vmware/applmgmt/PatchRunner.log on the source vCenter reveals the following error:
  

  2026-06-02T16:52:07.642Z vsphere_ui:Expand ERROR root ('Service account password file is present for %s but the service account is
  not present.This is not a valid scenario and cannot be corrected as part of expand hook, investigate the client code further to fin
  d the root cause and fix it.', 'vsphere-ui')
  2026-06-02T16:52:07.642Z vsphere_ui:Expand ERROR vsphere_ui Failed to expand patch patch_12 with version 12.0. Exception: ('Service
   account password file is present for %s but the service account is not present.This is not a valid scenario and cannot be correcte
  d as part of expand hook, investigate the client code further to find the root cause and fix it.', 'vsphere-ui')
  
  svcaccount_prestart_util.SvcAcctSetupException: ('Service account password file is present for %s but the service account is not present.This is not a valid scenario and cannot be corrected as part of expand hook, investigate the client code further to find the root cause and fix it.', 'vsphere-ui')
  2026-06-02T16:52:07.644Z vsphere_ui:Expand ERROR vmware_b2b.patching.executor.hook_executor Patch hook 'vsphere_ui:Expand' failed.
  Traceback (most recent call last):
    File "/storage/lifecycle/vlcm/current/stageDir3711702838/scripts/patches/py/vmware_b2b/patching/executor/hook_executor.py", line 74, in executeHook
      executionResult = systemExt

Environment

VMware Cloud Foundation 9.x 

Cause

The vsphere-ui service account is missing from the vCenter configuration. This typically occurs if Enhanced Linked Mode (ELM) is deactivated or broken before the vCenter upgrade to 9.x is completed. Per Broadcom documentation, vCenters must be on version 9.x before ELM is deactivated. See Deactivate Enhanced Link Mode (ELM) Using the SDDC Manager API

 

Resolution

Re-create the missing `vsphere-ui` service account on each affected vCenter to allow the upgrade to proceed.

Procedure:

1. Log in to the vCenter Server via SSH as root.
2. Obtain the machine ID by running the following command:
   
   /usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost

   *Note: Record the outputted <machine_id> for use in step 4.*

3. Verify if the vsphere-ui service account is missing:

   /usr/lib/vmware-vmafd/bin/dir-cli svcaccount list

4. If the account is missing, recreate it using the machine ID obtained in step 2:

   /usr/lib/vmware-vmafd/bin/dir-cli svcaccount create --name vsphere-ui-####

   *(Replace #### with the machine ID from step 2)*

5. Restart the vsphere-ui service:

   service-control --restart vsphere-ui

6. Repeat these steps for all vCenters in the SSO domain if they are also experiencing this issue.
7. Retry the vCenter upgrade from SDDC Manager.