vCenter: Stuck On Applying Computer Settings

Problem Description

Windows 2008 R2 vCenter stuck on applying computer settings.

Event logs shows the following errors:

Event 4, Security Kerberos, The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc01-ad01$. The target name used was GC/DC01-AD01.gascompany.com/gascompany.com. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (GASCOMPANY.COM) is different from the client domain (GASCOMPANY.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

Event 7038, Service Control Manager, The vpxd service was unable to log on as GASCOMPANYService.vCenter with the currently configured password due to the following error:
The trust relationship between this workstation and the primary domain failed.

Event 7000, Service Control Manager, The VMware VirtualCenter Server service failed to start due to the following error:
The service did not start due to a logon failure.

Resolution

The key is Event 7038, the trust relationship between this workstation and the primary domain failed.  To resolve the issue perform the following steps:

• Power off vCenter and edit settings to disconnect the Network Adapter.  By doing this, you will be able to get to the login screen.

• Login to vCenter using Local Credentials (in my case this was DC01-VCT01Administrator).  Re-enable Network Adapter and perform a ping using DNS to another server to confirm that the TCP/IP network stack is functioning

Now that we are in the server, it is time to resolve the actual issue, being the trust relationship with the primary domain.

• Run CMD as Administrator
• Type netdom resetpwd /Server:DomainControllerName /UserD:DomainAdministrator /PasswordD:*

You will be prompted to enter your password.  If all details are correct, you will be prompted to say machine account has been reset.

• Reboot your vCenter

When you login you will now see the prompt to state ‘the trust relationship between this workstation and the primary domain failed’

• Select > Switch User and login using Local Credentials
• Remove vCenter from the domain and join to a Workgroup
• Remove the vCenter Computer Object from Active Directory
• Reboot vCenter
• Join the domain