Problems with "Use Windows session credentials"

[EricBates]

I have successfully joined ESXi to my domain.

I can successfully login to ESXi with vSphere Client if I spell the username out: domain\user and explicitly supply the password.

I cannot login using the convenient "Use Windows session credentials" check-box. I get the error:

Windows session credentials cannot be used to log into this server. Enter a username and password.

The knowledgebase article: Logging on to an ESX host with Windows session credentials fails does not seem to apply because I double checked both the A record and the PTR record for the server from the client machine and they all resolve correctly.

During an attempt, /var/log/messages only reports:

Jan 31 23:36:30 Hostd: [2011-01-31 23:36:30.862 4028AB90 verbose 'Proxysvc Req03376'] New proxy client SSL(TCP(local=172.25.33.69:4379, peer=172.25.33.240:443))
Jan 31 23:36:40 Hostd: [2011-01-31 23:36:40.690 4028AB90 verbose 'HTTP server'] Sent response for HEAD /client/clients.xml (from /usr/lib/vmware/hostd/docroot)
Jan 31 23:36:48 Hostd: [2011-01-31 23:36:48.453 3FF81B90 verbose 'Proxysvc Req03377'] New proxy client SSL(TCP(local=172.25.33.69:4380, peer=172.25.33.240:443))
Jan 31 23:36:48 Hostd: [2011-01-31 23:36:48.685 3F1D2B90 verbose 'Proxysvc Req03378'] New proxy client SSL(TCP(local=172.25.33.69:4381, peer=172.25.33.240:443))
Jan 31 23:36:51 Hostd: [2011-01-31 23:36:51.712 3F1D2B90 verbose 'Proxysvc Req03379'] New proxy client SSL(TCP(local=172.25.33.69:4382, peer=172.25.33.240:443))
Jan 31 23:36:51 Hostd: [2011-01-31 23:36:51.716 FFEC0B90 verbose 'HTTP server'] Sent response for HEAD /client/clients.xml (from /usr/lib/vmware/hostd/docroot)

I don't really see anything in there that helps me understand. 172.25.33.69 is the client and 172.25.33.240 is the ESXi server.

I know this is just a nicety; but anyone have any thots?

Thanks.

[JAdkins11]

Did you ever find the answer you were looking for? I have this exact same issue. Like you I have checked A record, tried both using the host IP and hostname with no luck.

[tdupont]

I had a similar problem.

A and PTR records are fine.

I found if I used the netbios name instead of the FQDN I was able to use my session credentials.

If I used FQDN I had to type in my credentials.

[JAdkins11]

Thanks for the reply

I have tried the following:

hostname.example.com

hostname

IP Address

None of these have produced a successful login for some reason.

[compr00t]

Same problem here. ip, hostname, FQDN or netbios name did not worked while A and PTR were set and resolvable. Is there a solution for that?

[farkasharry]

Did you try this? kb.vmware.com/kb/1029531 

[compr00t]

Yeah: A-Record and PTR were set like the article suggested but none of them could solve my problem.

[satya1]

EricBates wrote:

I have successfully joined ESXi to my domain.

I can successfully login to ESXi with vSphere Client if I spell the username out: domain\user and explicitly supply the password.

I cannot login using the convenient "Use Windows session credentials" check-box. I get the error:

Windows session credentials cannot be used to log into this server. Enter a username and password.

The knowledgebase article: Logging on to an ESX host with Windows session credentials fails does not seem to apply because I double checked both the A record and the PTR record for the server from the client machine and they all resolve correctly.

During an attempt, /var/log/messages only reports:

Jan 31 23:36:30 Hostd: [2011-01-31 23:36:30.862 4028AB90 verbose 'Proxysvc Req03376'] New proxy client SSL(TCP(local=172.25.33.69:4379, peer=172.25.33.240:443))
Jan 31 23:36:40 Hostd: [2011-01-31 23:36:40.690 4028AB90 verbose 'HTTP server'] Sent response for HEAD /client/clients.xml (from /usr/lib/vmware/hostd/docroot)
Jan 31 23:36:48 Hostd: [2011-01-31 23:36:48.453 3FF81B90 verbose 'Proxysvc Req03377'] New proxy client SSL(TCP(local=172.25.33.69:4380, peer=172.25.33.240:443))
Jan 31 23:36:48 Hostd: [2011-01-31 23:36:48.685 3F1D2B90 verbose 'Proxysvc Req03378'] New proxy client SSL(TCP(local=172.25.33.69:4381, peer=172.25.33.240:443))
Jan 31 23:36:51 Hostd: [2011-01-31 23:36:51.712 3F1D2B90 verbose 'Proxysvc Req03379'] New proxy client SSL(TCP(local=172.25.33.69:4382, peer=172.25.33.240:443))
Jan 31 23:36:51 Hostd: [2011-01-31 23:36:51.716 FFEC0B90 verbose 'HTTP server'] Sent response for HEAD /client/clients.xml (from /usr/lib/vmware/hostd/docroot)

I don't really see anything in there that helps me understand. 172.25.33.69 is the client and 172.25.33.240 is the ESXi server.

I know this is just a nicety; but anyone have any thots?

Thanks.

Hi if able to ping domin try diffrent way of login

1-\\domain \username

2-usernam@domin.com

3-only user & password

Yours,

Satya

[compr00t]

I suppose you didn't understand the problem correctly...

Everybody here can login into ESX by entering manually the Domain\username and the password. The problem is that we want to login by using the checkbox "use windows session credentials" which fails all the time!

Everybody here created a A record to resolve the hostname and a PTR record to resolv the IP like this kb article is proposing (kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1029531) but the login with the windows session credentials is still not working!

[EricBates]

No, I gave up.

I have an alias in the start menu which provides the username as domain\username when I activate the sphere client (saves a little typing). And the domain authentication does, in fact, work; but I gave up on "use Windows Session Credentials."

I have a sneaking suspicion that it might work when I bring a working vSphere server into the mix. But currently all we have is the Client and ESXi.

[FROGGYJ]

I had the exact same issue when trying to connect to the netbios name....oddly enough I then tried connecting to the FQDN and it worked. I then disconnected and tried netbios again and it worked. I know others may of already tried that, but just food for though in case this helps someone else.

[BlargMaN00]

Don't know if anyone is still having this issue, but here is my scenario, and what I found...

I have my ESXi machine joined to my domain: DOMAINA.COM

Domain A has a trust with Domain B, Domain C and Domain D

I can log into the ESXi box manually with any credentials from any of those domains

When I run the client as a user from DOMAIN A, the checkbox works just fine.

If I run it as a user from any of the other 3 domains, it fails.

So, I think it is something to do with the way that the domain trust works, and how the credentials are passed into the client login screen.

Hope this helps someone...

JP

[EricBates]

I may have discovered that this problem hinges on whether one is using vCenter or simply connecting directly to an ESXi box. At one of our locations after purchasing a license and adding to vCenter to the mix, the "Use Windows session credentials" started working. I haven't repeated the test.

[___v___]

my experience for esx 4.1:

- I had forgotten that I had put the domain name in domain box in "Configuration" -> "DNS and Routing" to same as name of the esx server

- The reason why I did that was the box would not let me NOT specify domain name after I changed the machine name.

- Funny thing it let me join esx to domain; I could even log in using domain user\password. But when I tried with VI client "Windows session credentials cannot be used to log into this server".

- I tried everything NTP, PTR \ A records, DNS entries nothing worked.

- Finally I removed esx from domain.

- changed the domain name in the "DNS and Routing" box to the domain name I wanted esx to join

- joined the domain again and hurrrray!

Of course this is my mistake but I would have thought I would see that kind of errors..

- V

[BodoB]

Hi V,

Your issue solved the Problem! Thank you for the great work!

Greetings from Vienna, Werner

[lucvdv]

This is on ESXi 5.0, connecting from a Windows 7 client

I followed your tip to set the domain name before (re-)joining the domain, but it still doesn't work for me

I tried the FQDN (something like 'mydomain.local'), as well as the old netbios domain name (MYDOMAIN).

A and PTR records of the ESXi host both exist, and it is a member of the same domain as the win7 box.

I can log in by entering domain\username and password, but the "Use Windows session credentials" checkbox doesn't work (using the same domain account).

I do get the error message as in the KB article (the one that lists the cause as the missing PTR record): "VpxClient.SSPI.SSPIException: InitializeSecurityContext failed.. Error Code = '80090303'."

Something else I discovered: I have to add the AD user accounts directly in 'permissions' on EXSI.  The 'esx admins' group exists, but adding a user account to that group in the domain isn't enough, the account still cannot log on.  It seems to connect initally, but it hangs and times out at "loading inventory".

The error message that is given at the end isn't always the same: usually it is "the connection to the ESXi host was lost while (...)", but I've also seen something about the session having become invalid (don't remember the exact wording of either message).

After adding the user account straight instead of via a group, that problem disappeared.

[UmeshAhuja]

Hi,

Try passing the flags -s <VISERVER> -u <USER> -p  <PASSWORD> to the VI Client executable

Might work

[slimshade4545]

I was having the same issue, I was able to solve it by enabling scratch config in advanced settings of vsphere client.

Good luck!

[FROGGYJ]

I am away on vacation and will be returning Tuesday June 12th. I will have limited access to phone and email.

[BodoB]

Sehr geehrte Absender, ich bin derzeit nicht im Büro. In dringenden Fällen wenden Sie sich bitte an office@oberlaa-wien.at. Danke.

Mit süßen Grüßen

Ing. Werner Bodansky

Informationstechnik und Brandschutz