Guest operation authentication failed for operation Delete Directory on Virtual machine

[compwizpro]

Hello,

We've noticed an event that gets logged against almost every one of our VMs every day on about 25 minute intervals.  An event description example is " 10/30/2018, 7:29:32 AMGuest operation authentication failed for operation Delete Directory on Virtual machine <VM name>".  We think this started after upgrading vROPs from 6.7 to 7.0 as that was the only thing that changed in our environment but can't confirm.

The environment is vCenter 6.5 with  ESXi, 6.5.0, 7967591.  The VM hardware versions range from 9 to 13.  Hyperic is also loaded in vROPs but isn't set up to monitor all VMs.

Has anybody seen this to be caused by vROPs or a plugin installed in vROPs that tries to interact with VMs?  Are there additional logs we could look at to see the source of these operation attempts?  We would like to find out what is causing these operations and stop them.

Thanks in advance!

[bdamian]

Hi compwizpro,

We experienced the same problem after upgrading vROps 7.0. We change settings in vCenter Adapter.

In vROps (logged as Admin) > Administration > Solutions > VMware vSphere > Configure

Set "Enable Actions" to disable as shown below:

Please let me know if this solves your problem.

D.

[bdamian]

Finally we could stop the event generation by stopping the Discovery adapter service.

[compwizpro]

Thank you for that info bdamian.  I set the Enable Actions to Disable for the vcenter solution but the events are still generating.  Were there additional steps I had to perform?

Also, is there a way to see what actions are attempted to be performed on the VM?  Perhaps an automated task within vROPs that gets performed on VMs?

Thanks!

[bdamian · Accepted solution]

In vROps portal, go to Administration > vRealize Operations Service Discovery Management Pack >

Select the "Service Discovery Adapter" and then click in the Stop button (twice )

[compwizpro]

Sorry for the delay in response.  I was able to test stopping and starting the collection and that appears to have fixed it.  The events are no longer occurring on the VMs.

Thank you for all the help!

Thanks

-Michael Richter