vCenter Server Fails to Join Active Directory Domain Due to Clock Skew Error 31

Products

• VMware vCenter Server

Issue/Introduction

• Attempting to join a vCenter to an Active Directory Domain, fails with an error "Idm client exception: Error trying to Join AD , error code [31] "
  
  
• Attempting to join the Domain via CLI (/opt/likewise/bin/domainjoin-cli --loglevel verbose --logfile /var/log/domain.log join <domain_name> <ad_admin_user>) gives the following error:
  Error: ERROR GEN FAILURE [code 0x0000001f]
  
  
• Following error is seen in the vCenter Server /var/log/vmware/likewise/likewise.log:
  
  YYYY-MM-DDTHH:MM:SS. ERROR lwio: [0x7f0ed22ae640] GSS-API error calling gss_init_sec_context: 851968 (Unspecified GSS failure.  Minor code may provide more information)
YYYY-MM-DDTHH:MM:SS. ERROR lwio: [0x7f0ed22ae640] GSS-API error calling gss_init_sec_context: 100007 (Clock skew too great)
YYYY-MM-DDTHH:MM:SS. ERROR lsass: [0x7f9854ff9640] Failed to run provider specific request (request code = 8, provider = 'lsa-activedirectory-provider') -> error = 31, symbol = ERROR_GEN_FAILURE, client pid = 12239
  
  
• Attempting to configure a NTP server on the vCenter Server, gives the following error:
  <Server> is unreachable
  
  
• The following error is seen upon validating if vCenter Server is able to reach out to any open source NTP:
  
  ntpdate -q time.google.com
[2411138] : no server suitable for synchronization found
  
  
• Validate if port 123 is open on the vCenter Server and ESXi host for bidirectional traffic:
  nc -uzvw 2 time.google.com 123

Environment

vCenter Server 8.x

Cause

The domain join failure is caused by a time skew (clock synchronization issue) between the vCenter Server, ESXi host and the target Active Directory Domain Controller. Active Directory relies on the Kerberos protocol for authentication, which strictly requires the clocks of the joining machine and the Domain Controller (DC) to be synchronized, typically within a 5-minute tolerance. If the drift exceeds this threshold, the secure context initialization fails.

Resolution

1. Ensure bidirectional traffic on UDP port 123 is open between the vCenter Server, ESXi host and the NTP Server.
2. Configure the NTP server on vCenter Server and ESXi host. 
3. Attempt to join the AD domain via the vCenter UI.