ESXi Host Client AD user login failure: 'Permission to perform this operation was denied'

Products

• VMware vSphere ESXi

Issue/Introduction

• When attempting to log in to an ESXi host managed by vCenter Server using an Active Directory (AD) user via Host Client, it failed and the error "Permission to perform this operation was denied" is displayed.
• The permission settings on the Host Client have been unexpectedly cleared.
• The following logs are output in /var/run/log/hostd.log
  
  YYYY-MM-DDTHH:MM:SSZ In(166) Hostd[#######]: [Originator@6876 sub=SysCommandPosix] ForkExec(/usr/lib/vmware/likewise/bin/lw-lsa) ######
YYYY-MM-DDTHH:MM:SSZ Wa(164) Hostd[#######]: [Originator@6876 sub=UserDirectory] User lookup failed for 'DOMAIN\Username'
YYYY-MM-DDTHH:MM:SSZ Er(163) Hostd[#######]: [Originator@6876 sub=Vimsvc] Principal lookup failed: 'DOMAIN\Username' not found.
YYYY-MM-DDTHH:MM:SSZ Wa(164) Hostd[#######]: [Originator@6876 sub=UserDirectory] User lookup failed for 'DOMAIN\Username'
YYYY-MM-DDTHH:MM:SSZ In(166) Hostd[#######]: [Originator@6876 sub=Vimsvc] [PermissionValidation] Removed ACE for user: DOMAIN\Username
  
  
• Local user login to Host Client works normally.

Environment

VMware vSphere ESXi 8.x

Cause

When the ESXi host performed a regular check of AD information, unstable access to AD caused the host to determine that the target AD users were invalid, and the access permissions were cleaned up on the ESXi host side.
Consequently, the necessary permission settings for AD user login to the ESXi Host Client were lost, resulting in the login denial.

Resolution

The issue can be resolved by adding the permission settings.
Refer to the following KB article for corrections.

"Permission to perform this operation was denied", unable to login to ESXi host using AD/Local user Credentials