ESXi 8.0 host becomes intermittently unresponsive due to Active Directory connectivity timeouts.

Products

• VMware vSphere ESXi

Issue/Introduction

An ESXi 8.0 host intermittently enters a Not Responding or Disconnected state in vCenter Server. VMs continue to run but are shown as disconnected. The host may auto-recover without intervention after several hours.

Specific log signatures include:

/var/run/log/hostd.log: error hostd[ID] [Originator@6876 sub=Default] DJGetComputerDN: 0x9cb9: The domain is offline
warning hostd[ID] [Originator@6876 sub=Default] hostd performance has degraded due to high system latency
info hostd[ID] [Originator@6876 sub=Default] hostd detected to be non-responsive

/var/run/log/syslog.log: lwsmd[ID]: [netlogon] CLDAP ping to cached DC #### failed
lwsmd[ID]: [netlogon] CLDAP timed out: ####.COM
lwsmd[ID]: [lsass] Found domain '####.COM' to be offline while resolving its objects.

/var/run/log/vpxa.log: error vpxa[ID] [Originator@6876 sub=vpxavpxaInvtHost] [VpxaInvtHost::QueryNetworkHint] Failed to query network hint: vmodl.fault.HostCommunication
warning vpxa[ID] [Originator@6876 sub=Default] [VpxaHalCnx] No connection to hostd; [Connection reset by peer]

Environment

ESXi 8.0

Cause

This issue occurs when the ESXi hostd management agent triggers its periodic ValidatePermissions() background task (typically every 90 minutes). If the Active Directory (AD) Domain Controllers are unreachable or experiencing high latency via the Likewise (lwsmd) service, hostd threads may hang while waiting for a response from the domain. This leads to a mutex deadlock that renders the management agents unresponsive.

The host auto-recovers once the network path to the AD environment is restored or the internal Likewise timeouts are reached, releasing the blocked threads.

Resolution

There is no specific ESXi configuration change to prevent the ValidatePermissions() task from reaching out to AD if the host is domain-joined. The permanent fix involves ensuring stable network connectivity to the Active Directory environment.

VCF Environments:
For VCF deployments, ensure that the management network has redundant paths to the Domain Controllers and that firewall rules permit traffic on the required ports (88, 389, 445).

Non-VCF / Standard ESXi:
If the issue persists despite stable networking, consider implementing the lwisOomCheck service (available in ESXi 8.0 Update 3e and later) to monitor Likewise health.

If the host is able to reach AD and still issue persists after successful checks as mentioned above, Engage Broadcom support for further assistance.

Additional Information

ESXi hosts disjoins intermittently from Active Directory domain & the ESXi host shows not responding in the vCenter server