AD account keeps being blocked because Aria Operations for Logs keeps trying to login using stale password

Products

• VCF Operations

Issue/Introduction

An Active Directory (AD) account experiences frequent lockouts because Aria Operations for Logs continues to attempt authentication using stale credentials.

In the /storage/core/loginsight/var/runtime.log on Aria Operations for Logs, the following error is observed during the automated "active-directory-check":

[<YYYY-MM-DD> <Time>+0000] ["NodeLocalChecksExecutor-thread-1"/<IP> INFO] [com.vmware.loginsight.prodcheck.service.InProductionChecksService] [Attempting to run check active-directory-check]
[<YYYY-MM-DD> <Time>+0000] ["CheckPerformer-thread-1"/<IP> INFO] [com.vmware.loginsight.prodcheck.lib.ActiveDirectoryCheck] [AD server <AD_server_IP> replied to PING within 5000 ms]
[<YYYY-MM-DD> <Time>+0000] ["CheckPerformer-thread-1"/<IP> ERROR] [com.vmware.loginsight.aaa.krb5.ActiveDirectoryQueryHelper] [Invalid username or password for host <AD_server_IP>, won't try again on other servers]
[<YYYY-MM-DD> <Time>+0000] ["CheckPerformer-thread-1"/<IP> ERROR] [com.vmware.loginsight.aaa.krb5.ActiveDirectoryQueryHelper] [Error while logging into active directory]
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090451, comment: AcceptSecurityContext error, data 775, v3839^@]

Environment

Aria Operations for Logs 8.x

Cause

Residual or outdated Active Directory configuration in Aria Operations for Logs uses stale credentials for domain binding. This triggers automated lockout loops during routine system health checks (ActiveDirectoryCheck).

Resolution

To resolve the account locking issues, update the authentication configuration and restart the services:

1.  Navigate to Configuration > Authentication in the Aria Operations for Logs UI.
2.  Select the Active Directory, and update the password to the current valid one.
3.  SSH into the Aria Operations for Logs appliance as root and restart the services:
    "service loginsight restart"