Unable to place ESXi host in Maintenance Mode due to "UNAUTHORIZED" error for vsansvc service account

Products

• VMware vCenter Server

Issue/Introduction

When attempting to place an ESXi host into Maintenance Mode or performing cluster remediation via vSphere Lifecycle Manager (vLCM), the operation fails or is skipped. The vSAN Data Migration Pre-check or the vCenter task console reports an authentication failure related to the vSAN Data Persistence Service account.

Symptoms:

• Hosts fail to enter Maintenance Mode.
• vLCM remediation tasks skip hosts with a message indicating transient reasons.
• Error logs (vmware-vsan-health.log ): Failed to get Bearer token with error "Something went wrong while trying to reset password for username vsansvc-######"
• Error code: com.vmware.vcenter.svcaccountmgmt.unauthorized
• Directory error: Invalid Credential, VMware directory error[9234]

Environment

• VMware Cloud Foundation (VCF)
• VMware vCenter Server
• vSphere Lifecycle Manager (vLCM)

Cause

This issue is caused by a credential mismatch or an unauthorized status for the vsansvc (vSAN Service) managed account. This occurs when the vCenter internal Machine GUID does not match the GUID suffix used in the service account registration, or when the Workload Control Plane (WCP) solution user certificate has expired or is out of sync. This prevents vCenter from rotating the service account password required for data persistence tasks during maintenance mode entry.

Resolution

To resolve this issue, restart the vSAN health services to refresh the service account state. If the issue persists, a full service restart or registration repair may be required.

1. Restart vSAN Health Service: Log into the vCenter Server via SSH and run: service-control --restart vmware-vsan-health

2. Alternative: Full vCenter Service Restart: If the single service restart does not resolve the issue, restart all services: service-control --stop --all && service-control --start --all

3. Verify Remediation: Retry placing the host in Maintenance Mode or restart the vLCM remediation task.

Additional Information

In some environments, if service restarts do not resolve the 9234 error, it may be necessary to use the lsdoctor tool to repair service registrations or to regenerate the WCP solution user certificates. Refer to Broadcom KB 383110 for detailed machine ID mismatch remediation steps.