Upgrade To vCenter 5.1: Unable To Authenticate Directly To ESXi Host Using Active Directory

Problem Statement

After upgrading to vCenter 5.1 and ESXi 5.1 U1, Active Directory authentication to an ESXi Host no longer works.  Using the vSphere Client error message ‘cannot complete login due to incorrect user name or password’ is received.

Authenticate 01

Quick Checks

1. Single Sign On checked, LDAP Active Directory authentication source working for vCenter and another ESXi Host.

2. Permissions checked, ‘Administrators’ Active Directory Security Group applied to vCenter and permissions propagated to child objects.

3. Authentication Services Services, Active Directory being used and Computer Object is valid.

Troubleshooting Steps

I tried to remove the host from Active Directory and re-authenticate.  Hosts and Clusters > Host > Settings > Manage > Authentication Services

Authenticate 02

An error message appeared stating that ‘the user or group named VMFOCUS\domain^admins does not exist’.

Authenticate 03

The Permissions tab on the affected ESXi Host didn’t show a VMFOCUS\domain^admins group

Authenticate 04

I added the VMFOCUS\Domain Admins group to the top level and inherited permissions.  Another quick try and I wasn’t able to login to the ESXi Host using the vSphere Client.

This time the Leave Domain setting worked.  Plus I also deleted the Computer Object for my ESXi Host from Active Directory.

Next, I rejoined the Domain and tried to login  directly to the ESXi Host directly using Active Directory credentials, which again failed.

Resolution

I added the Domain Admins group directly to the ESXi Host

Authenticate 05

When using the vSphere Client I deselected ‘Use Windows session credentials’ and manually entered Administrator and was able to login successfully!

Authenticate 06

Simple when you know what is causing the issue.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s