Aria Automation Deployments Fail with "ou_validation_failed" After Active Directory OU Changes

Products

• VCF Automation

Issue/Introduction

Following an Active Directory (AD) reorganization where the target Organizational Unit (OU) for computer accounts is changed, new deployments in VMware Aria Automation may fail.

Administrators typically find they cannot update the existing Relative DN (OU) directly within current Aria Automation Project settings because existing virtual machines are still tied to it. When attempting to bypass this by modifying the cloud template (blueprint) to handle the new AD placement, the deployment fails during the provisioning phase.

Error Message: Reviewing the extensibility create_machine logs reveals the following error:

ou_validation_failed

Additionally, changes made to the blueprint to correct the OU path do not seem to take effect when users request the catalog item from Service Broker.

Environment

VMware Aria Automation 8.x

Cause

The deployment failures are caused by a combination of blueprint publishing workflows and Active Directory validation logic:

1. Stale Blueprint Version: The blueprint YAML was modified to include the new AD properties, but a new version was not created and published. Consequently, Service Broker continued to deploy an old, cached version of the catalog item that lacked the updated logic.

2. Missing Staging OU (Validation Failure): The system's AD integration logic dictates that a computer object must first be created in a staging OU (relativeDN) before it can execute a move action to its final destination (finalRelativeDN). Because the old project-level OU was deleted or invalid in Active Directory, the initial deployment validation failed immediately, skipping the move action entirely.

Resolution

Implementation Steps

1. Validate Active Directory OUs Ensure that the OUs you intend to use for both the relativeDN (staging) and finalRelativeDN (destination) actively exist within your Windows Active Directory environment.

2. Enable Blueprint Overrides In the Aria Automation AD Integration settings, ensure the toggle for allowOverrideRelativeDN is turned ON. If this is off, the system will ignore the relativeDN provided in the blueprint and force the project-level OU (which is currently broken).

3. Update Blueprint Properties Edit your blueprint YAML to explicitly define both properties under the machine resource:

   • Set relativeDN to a valid, existing path (this overrides the broken project path).

   • Set finalRelativeDN to your new, desired target OU.

4. Version and Publish the Blueprint

   • Save your YAML changes.

   • Click Version to create a new version of the blueprint.

   • Click Publish on that specific version to push the updated logic to the Service Broker catalog.

5. Deploy and Test Log into Service Broker, request the newly published version of the catalog item, and verify the deployment succeeds and the machine lands in the correct OU.

Additional Information

Note on Existing Deployments: You cannot retroactively change the project-level paths for machines that are already deployed. However, you can utilize the finalRelativeDN property as a Day-2 action or script to move those existing machines to a different OU after they have been provisioned.

 

Understanding AD Custom Properties

Before updating the blueprint, it is critical to understand the difference between the two AD placement properties and how they interact with the project settings:

Property	relativeDN	finalRelativeDN
Purpose	The source OU where the computer object is initially created.	The destination OU the computer object is moved to after provisioning.
Used by Action	CREATE_MACHINE (also base for DELETE / ADD_TO_SECURITY_GROUP)	MOVE_MACHINE only
Execution Phase	At provisioning time.	A later substage, only after a successful create.
Project Fallback	Yes, falls back to the project integration's OU if not set or overridden.	No fallback; only used if explicitly set in the blueprint.
Override Gate	Blueprint value only applies if the admin enabled allowOverrideRelativeDN.	Always read from the blueprint custom property.