vSphere Endpoint 'Access Denied' in vCAC 5.2

[Jer2224]

Hi all,

Having upgraded my vCAC installation to 5.2, I am now having issues with the vSphere Endpoint and vCenter.

Essentially, the upgrade wasn't an upgrade, it was an un-install of 5.1 and fresh install of 5.2 (new DB etc). I also un-installed all the agents etc, and re-installed as part of the new 5.2 build. (Also, SQL instance hosting the DB is on the same VM as  vCAC).

Now however, when I enter my new vCenter Endpoint and connect it to a new agent on the vCenter server, I get the following error reported a few times per minute in the vCAC console log viewer:

Severity: Error

Source: Repository

Instance Name: Repository

Username: <'DOMAIN\vCAC service account'>

Machine: <vCAC Host>

Message: Access Denied ('DOMAIN\vCenter Domain service account'). Entity 'TrackingLogItem' Inner Exception: Exception has been thrown by the target of an invocation. Base Exception: Access Denied ('DOMAIN\vCenter service account'). Entity 'TrackingLogItem'

The Endpoint for vCenter is configured to use the SDK address for the vCenter with HTTPS, and I have tried it using either 'Integrated' or 'DOMAIN\vCenter service account', but whatever combination I use, I always get the error. The agent on vCenter is set to logon as the Domain\vCenter service accont, not Local System Account as per the documentation.

There are no firewalls or other infrastructure between the 2 VMs (vCenter and vCAC host).

This is driving me crazy - anyone got any thoughts on what could be causing this?

Many thanks in advance,

Jeremy.

[hvkt]

What privilege does DOMAIN\vCAC service account have under vCAC database?

Don't think it has anything to do with agent.  The error comes from Repository source so first make sure this service account (running as app pool identity) has enough privilege (db owner) under vCAC database.

[Jer2224]

Thanks for the suggestion. The DOMAIN\vCAC service already has the dbo role on the vCAC database, and is running as the app pool identity. The strange thing is the error references the DOMAIN\vCenter service account as being access denied....! Any other thoughts?

[tekemclain]

Had the same issue and the fix was to make sure the AD user was a member of the local administrators group on the machince vCAC is installed on.