vCenter Server disconnected from Active Directory due to machine account password rotation failure

Products

• VMware vCenter Server

Issue/Introduction

• 3rd party Backups using AD-integrated accounts fail.
  
  
• Users are unable to log in to vCenter using Active Directory credentials.
  
  
• vCenter -  /var/log/vmware/sso/ssoAdminserver.log shows:
  
  Local host is not joined.
  
  
• vCenter - /var/log/vmware/likewise/likewise.log contains:
  
  Error: Failed to change machine password for #### (error = 4294967295)
Error: Failed to change machine password for #### (error = 86)
KRB5 Error code: -1765328360 (Message: Preauthentication failed)

Cause

This issue occurs when the vCenter Server's machine account password fails to rotate within Active Directory. vCenter uses the Likewise service to manage the domain membership; if the password synchronization fails, the vCenter loses its trusted relationship with the domain. This can be caused by issues or changes on the Active Directory side. 

Resolution

To resolve this issue, perform a domain leave and re-join:

1. Log in to the vCenter Server UI.
   
   
2. Navigate to Administration > Single Sign-On > Configuration > Identity Provider > Active Directory Domain.
   
   
3. Select Leave AD to remove the vCenter from the Active Directory domain.
   
   
4. Reboot the vCenter Server.
   
   
5. Return to the vCenter Server UI and select Join to re-add the vCenter to the domain using an account with appropriate permissions.
   
   
6. Reboot the vCenter Server again to ensure all services start correctly.

If the issue persists, consult with your Active Directory administration team to investigate why machine account password rotations or join operations are failing on the domain.