I figured out our problem. Hopefully this helps someone else.
When our users changed passwords it was due to password expiration or forgotten password. However they still tried to login to vCenter and were denied each time. Eventually getting their password changed after logging into a Windows host and having it prompt them or having an administrator reset their password.
But because the passwords failed previously they were logged as "failed attempts" by the likewise authentication service which is what binds vCenter to active directory. The attempts are not reset when the user is reset/unlocked in Active Directory.
To view failed attempts to the user you can do the following....
- ssh to the vCenter appliance as "root".
- run the command '/sbin/pam_tally --user username@example.com' without the quotes.
You will get output something like....
User username@example.com (109733597) had 8
Which means there were 8 failed attempts for username@example.com (the number is a UID).
To fix this run the following command
/sbin/pam_tally --user username@example.com --reset
This will reset the failed attempts to 0. Check it with the first command.
In our scenario the users were still able to login to a windows box and check "use windows credentials" when connecting to vcenter. They just couldn't enter the username and password directly into the vSphere client.
