Troubleshooting ESXi Domain Join Failures due to Stale Kerberos Configuration (VMware ESXi)

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to join an ESXi host to an Active Directory domain, the operation fails with error LW_ERROR_DOMAIN_IS_OFFLINE (code 0x00009cb9). This error occurs even when network connectivity tests (such as ping or DNS lookups) to the domain controllers appear successful.

 

Environment

• VMware vSphere ESXi
• Active Directory domain environment

Cause

This issue is typically caused by stale or cached domain realm configuration entries within the /etc/krb5.conf file on the ESXi host. Following a partial decommissioning of domain controllers, residual DNS records may still exist, and the local Kerberos/Likewise daemon (lsassd) relies on these cached locator details rather than querying active domain controllers.

Resolution

To resolve this issue, you must purge the stale Kerberos configuration and flush the Likewise daemon cache.

1. Log in to the ESXi host via SSH or the Direct Console User Interface (DCUI) as the root user.
2. Create a backup copy of the existing Kerberos configuration: cp /etc/krb5.conf /etc/krb5.conf.bak
3. Edit the /etc/krb5.conf file and remove all entries and stanzas related to the problematic domain realm.
4. Reboot the ESXi host to flush all cached Likewise/Kerberos locator states and the local DNS cache.
5. Once the host is online, join the host to the Active Directory domain via the command line: /usr/lib/vmware/likewise/bin/domainjoin-cli join [DOMAIN_NAME]

Note: Replace [DOMAIN_NAME] with your actual Active Directory domain name.

Additional Information

Host Domain Join Fails with LW_ERROR_DOMAIN_IS_OFFLINE Error

For defects ESXi and enhancements, we recommend that users subscribe to this article to receive updates on the fix status. Reference: How to subscribe to articles.