vCSA 6.7 Active Directory Domain Join - Access Denied

[ProjectD22]

Hello there!

I am currently rebuilding our internal horizon environment which is currently running on a vcenter server für windows.

The new vCenter Server Appliance 6.7u3 is already setup. Now I need to join the vCSA to our active directory domain. But when I try I get the following error:

user [Service Account] cannot access domain [AD Domain]

So I looked through the security logs on the domain controller. And there they only show successful logins of the service account i'm using. So I gave the service account domain admin rights to see if rights where a problem. Still the same error. Next I tried to join using the shell with the command:

/opt/likewise/bin/domainjoin-cli join [AD Domain] [Service Account] ['Password']

Now I'm getting a different message:

Error: ERROR_ACCESS_DENIED [code 0x00000005]

So I went and googled this error and found following VMware KB Article:

https://kb.vmware.com/s/article/77295

What it says is that domain controllers using SMBv3 have got a variable set which rejects unencrypted access. You can fix that with the provided powershell command. The problem is that we're stil using Windows Server 2008 R2 for two of our three domain controllers. Only the third one with windows server 2012 r2 works with this command because SMBv3 isn't natively supported on Windows Server 2008.

The vCSA and the domain controllers are in the same subnet and the windows firewall is off.

If you need any additional informations feel free to ask.

Is there anyone who can help me?

[Alex_Romeo · Accepted solution]

Hi,

This is a nice problem, you don't have many solutions. The advice I want to give you is to update the 2008R2 domain controllers at least to the 2012r2 version, if not even to the 2016 version.

It is an activity that I have recently carried out and it is really simple and fast.

If you don't want to update, you can create new servers, join the domain, install the ADDS role and move the roles from 2008R2 to the new DCs.

Keep in mind that 2008R2 is in "end of life"

ARomeo

[scott28tt]

Moderator: Moved to vCenter Server

[ProjectD22]

Thank you for your answer.

I guess you're right. The domain controllers won't be upgraded within the next few months. So I'll just use ldap instead.