vCenter disjoined from domain

[TheUsD]

The datastore that housed my vCetner had an unexpected reboot. Once the ZFS container completed the unexpected reboot, I restarted vCenter via the esxi host. When the vCenter came back online, the domain credentials to log into vCenter stopped working. After doing some poking around, I noticed vCenter said it was no longer joined to the domain.

Attempted to reconnect to the domain but receiving the following error:

Verified the credentials work and have the ability to join to the domain. Verified the NTP is correct. No configuration changes were made prior to losing connection to the domain. vSphere Client version 7.0.3.00700

[Alex_Romeo]

Hi,

If you access the VAMI (https://<ip>or<fqdn>:5480) enable ssh and try joining from the command line:

/opt/likewise/bin/domainjoin-cli join (domain) (user name) ('password')

...and reboot the vCenter.

regards,

Alex_Romeo

[TheUsD]

Thank you for the fast reponse.
I did what you advised and received the following:

Please note, I did not reboot the vCenter, yet due to the error message.

[pmichelli]

You don't need vCenter in AD to be able to login to it.  IWA is being deprecated anyhow.

What we've done is leave it off the domain and configure AD over LDAP as an identity source.

Then you have to login as user@domain.com vs adname\username

I did this once I migrated last year from 6.7 to 7.x .  Both my Prod and DR are setup this way.

Why do you want to have vCenter in AD anyhow? Bit of a security risk if you ask me

[TheUsD]

I already login via username@domain.com

However, I still would like vcenter joined to the domain.

[pmichelli]

There is really no benefit as I see it:

If you join to AD, you don't need a service account to query AD, it is done by the vCenter record that gets created in AD

If you use AD over LDAP, you provide a read only account that can query AD.

If your AD gets hosed and this is joined, you now have an attack vector to vCenter

[TheUsD]

I really appreciate your concerns and I hear your stance, but this does not resolve the issue I am dealing with.

[pmichelli]

I understand. I was only trying to suggest an alternative that will still work.  I hope you're able to resolve the issue somehow.  

Did you reset the AD computer object account (or delete it) before trying to join again?  I know from experience with Windows 10/11 laptops that I rebuild using the same hostname.  If I don't reset the AD computer account , I cannot join it to the domain.

Perhaps this may help you.  Good luck !

[TheUsD]

Yes, I did take the steps mentioned above.

I also attempted to rename the vcenter appliance to another name, such as vsphere.domain.com and it would not take the changes. grr

[RajeevVCP4]

did you check your DNS configuration

https://kb.vmware.com/s/article/2122383

reverse and forward lookup zone ?