Joining esxi to active directory domain fails due to incorrect credentials even though credentials are correct

active-directoryauthenticationvmware-esxivmware-vsphere

VMware vSphere ESXi 5.1.0 patched to 1157734. Using the vSphere Client 5.1.0 1064113 to connect to the ESXi host directly.

In ESXi DNS and Routing the Host Identification Domain is set to test.local and in the Security Profile the Firewall outgoing connections for "Active Directory All" are enabled.

In AD a user name esxiadmin is created and the user is a member of "Domain Admins".

In ESXi -> Authentication Services -> Properties -> Select Directory Service Type -> Active Directory. Then enter test.local into the Domain Settings Domain field. Then click Join.

Enter user credentials as esxiadmin with correct password results in error:
"The specified domain either does not exist or could not be contacted."

Enter user credentials as "test\esxiadmin" with correct password results in error:
"Cannot complete login due to an incorrect user name or password."

Enter user credentials as "test.local\esxiadmin" with correct password results in error:
"Cannot complete login due to an incorrect user name or password."

I have verified that the credentials are fine, the username and password match. ESXi logs do not show anything related to this login.

Any suggestions on what the problem may be or where to continue troubleshooting?

Update/Resolution

This turned out to be an AD/DNS issue of some sort. DNS was installed first, and only then (later) AD was installed. Removing AD and DNS, and then installing DNS as part of the AD install fixed this issue. Thanks to everyone who responded.

Best Answer

There are a few things you could try/check:

  • Have you created a Global Security group in Active Directory with the name ESX Admins? ESXi uses this group to determine who is allowed to logon to the server. Add users to this group to grant them logon permissions.

  • Are the time and date settings set correctly? If there is more than a 5 minute difference between the domain controller and the ESXi server, it won't be possible to authenticate accounts.

  • Has the ESXi server been added to the DNS Server? You need to have an A record configured in your forward lookup zone and reverse lookup zone so the ESXi hostname and IP can be resolved. Make sure you get the correct hostname when you ping the server on it's IP address, also make sure you get the correct IP address when you use "ping -a" to ping the hostname.

Related Topic