joining esxi to active directory domain fails due to incorrect credentials even though credentials are correct

Question

VMware vSphere ESXi 5.1.0 patched to 1157734. Using the vSphere Client 5.1.0 1064113 to connect to the ESXi host directly.

In ESXi DNS and Routing the Host Identification Domain is set to test.local and in the Security Profile the Firewall outgoing connections for "Active Directory All" are enabled.

In AD a user name esxiadmin is created and the user is a member of "Domain Admins".

In ESXi -> Authentication Services -> Properties -> Select Directory Service Type -> Active Directory. Then enter test.local into the Domain Settings Domain field. Then click Join.

Enter user credentials as esxiadmin with correct password results in error: "The specified domain either does not exist or could not be contacted."

Enter user credentials as "test\esxiadmin" with correct password results in error: "Cannot complete login due to an incorrect user name or password."

Enter user credentials as "test.local\esxiadmin" with correct password results in error: "Cannot complete login due to an incorrect user name or password."

I have verified that the credentials are fine, the username and password match. ESXi logs do not show anything related to this login.

Any suggestions on what the problem may be or where to continue troubleshooting?

Update/Resolution

This turned out to be an AD/DNS issue of some sort. DNS was installed first, and only then (later) AD was installed. Removing AD and DNS, and then installing DNS as part of the AD install fixed this issue. Thanks to everyone who responded.

Solution

There are a few things you could try/check:

• Have you created a Global Security group in Active Directory with the name ESX Admins? ESXi uses this group to determine who is allowed to logon to the server. Add users to this group to grant them logon permissions.

• Are the time and date settings set correctly? If there is more than a 5 minute difference between the domain controller and the ESXi server, it won't be possible to authenticate accounts.

• Has the ESXi server been added to the DNS Server? You need to have an A record configured in your forward lookup zone and reverse lookup zone so the ESXi hostname and IP can be resolved. Make sure you get the correct hostname when you ping the server on it's IP address, also make sure you get the correct IP address when you use "ping -a" to ping the hostname.

Comments

[Chopper3]

I've never really understood why people wish to do this, how often do you plan on logging into the actual host?

[Keith Stokes]

Slightly off topic, but it's good for enforcing password policies. It's not often one logs into the hosts, but it does happen for managing resources or adding/deleting guests.

[Reality Extractor]

@Chopper3 it's really a matter of business continuity, if you join the host to AD then you are very unlikely to ever lock yourself out of the host due to forgotten or misplaced root password (which you could get back in other ways, but still, AD is just a lot easier)

[Reality Extractor]

Thanks for the suggestions Sidney, everything is configured correctly, ESX Admins exists, time&date is fine, ping works from AD DC and from ESXi host forward and reverse, DNS entries exist. Host is using AD DNS for resolution.