Joining ESXi host(s) or VMware vCenter Server Appliance to an Active Directory domain fails with error: Undocumented exception

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

Joining an ESXi host or vCenter Server Appliance to an Active Directory domain fails if the account provided is not a Domain Administrator.

• Attempting to use a standard domain user to join an ESXi host or vCenter Server Appliance to an Active Directory domain may fail.
• When the domain has limited rights assigned to user accounts, you may see the error:
  
  Error: Undocumented exception [code 0x00009efc]
  An undocumented exception has occurred. Please contact Likewise technical support and use the error code to identify this exception.

Environment

VMware vCenter Server
VMware vSphere ESXi

Cause

This issue occurs when the account used to join the object to the Active Directory domain does not have the required privileges to traverse the OU where the computer objects should reside.

Resolution

To resolve this issue, provide a domain administrator account while performing the domain join operation.

To work around this issue, allow standard AD users to join the domain.

See guidance below:

• Have a domain administrator create the necessary computer object in the required OU and assign it to the user account performing the join operation.
• Delegate the required permissions on the OU where the ESXi computer account should reside
  • See the following documentation from Microsoft for Delegating permissions in Active Directory:
    Delegate Permissions for Group Policy
    Delegate "Domain Join Only" permission to a standard user
• Attempt joining the relevant object to the Active Directory domain

Additional Information

Enabling logging for Likewise agents on ESXi/ESX