Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Adding a host to Active Directory domain using vSphere Authentication Proxy(vmcam) fails intermittently with error code 41737 (76543)

Last Updated: 2/11/2020Categories: TroubleshootingTotal Views: 6676Language:
Chinese (Simplified)JapaneseEnglish

2 like this article

Subscribe to get an email
newsletter with new updates

2 people found this helpful Please provide article feedback:

Symptoms

Unable to join ESXi hosts using autodeploy  and  authentication proxy.

It fails with an error similar to "The specified vSphere Authentication Proxy Server is not reachable, or has denied access to the service"

During the second boot of ESXi host it can join to the domain.

The ESXi  will show similar error as below during domain join.

hostd.log
2019-05-06T15:30:04.964Z verbose hostd[EB81B70] [Originator@6876 sub=PropertyProvider opID=b6644746 user=vpxuser] RecordOp ASSIGN: info, haTask--vim.InternalStatsCollector.queryLatestVmStats-183332122. Applied change to temp map.
LikewiseGetDaemonStatus: lwsmd is running
LsaSrvVerifyLwsmStatus: lwsmd ping successful
LikewiseStopService: stopping service: lsass
[LwSetupMachineSession:278] LwKrb5GetTgt(): 41737
[LikewiseJoinDomainWithMachineAccount:1015] LwSetupMachineSession(): 41737
2019-05-06T15:30:05.447Z error hostd[F5C6B70] [Originator@6876 sub=ActiveDirectoryAuthentication opID=AuthJoinDomainFormMediator-apply-225860-ngc:70022467-df-48-4741 user=vpxuser:Domain\User] vmwauth Exception: Exception 0xffff0000: Unknown exception
2019-05-06T15:30:05.448Z verbose hostd[F5C6B70] [Originator@6876 sub=PropertyProvider opID=AuthJoinDomainFormMediator-apply-225860-ngc:70022467-df-48-4741 user=vpxuser:AFI\ia-mparva] RecordOp REMOVE: latestPage[3661], session[52554650-c0e6-6118-7801-5b45e8162ce7]52d1f489-0bfd-ec51-ea81-cad163f84d35. Applied change to temp map.
2019-05-06T15:30:05.448Z verbose hostd[F5C6B70] [Originator@6876 sub=PropertyProvider opID=AuthJoinDomainFormMediator-apply-225860-ngc:70022467-df-48-4741 user=vpxuser:Domain\User] RecordOp ADD: latestPage[3671], session[52554650-c0e6-6118-7801-5b45e8162ce7]52d1f489-0bfd-ec51-ea81-cad163f84d35. Applied change to temp map.
2019-05-06T15:30:05.448Z verbose hostd[F5C6B70] [Originator@6876 sub=PropertyProvider opID=AuthJoinDomainFormMediator-apply-225860-ngc:70022467-df-48-4741 user=vpxuser:Domain\User] RecordOp ASSIGN: latestEvent, ha-eventmgr. Applied change to temp map.
2019-05-06T15:30:05.448Z info hostd[F5C6B70] [Originator@6876 sub=Vimsvc.ha-eventmgr opID=AuthJoinDomainFormMediator-apply-225860-ngc:70022467-df-48-4741 user=vpxuser:Domain\User] Event 3671 : Join domain failed.
2019-05-06T15:30:05.448Z info hostd[F5C6B70] [Originator@6876 sub=Vimsvc.TaskManager opID=AuthJoinDomainFormMediator-apply-225860-ngc:70022467-df-48-4741 user=vpxuser:Domain\User] Task Completed : haTask-ha-host-vim.host.ActiveDirectoryAuthentication.joinDomainWithCAM-183332119 Status error

When doing a packet capture we notice below

Error: KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN

Note:The preceding log excerpts are only examples.Date,time and environmental variables may vary depending on your environment.

Purpose

To join the ESXi host to domain

Cause

vCenter and ESXi  host is contacting different domain controllers of the AD domain. Due to this, if there is any replication delay between those two domain controllers,the ESXi  host might not be able to find the computer object created for it by the VC on the AD setup, thus resulting in LW_ERROR_KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN error.

Impact / Risks

No Impact

Resolution

This issue is resolved in ESXi 6.7 Patch ESXi670-201912001 (ESXi 6.7 P01) and in ESXi 6.5 Patch ESXi650-201912002 (ESXi 6.5 P04). To download go to  the Customer Connect Patch Downloads page

Refer to ESXi 6.7 patch  release notes   and ESXi 6.5 Patch release notes

Workaround

Delay the domain join procedure post account creation. Rebooting the ESXi host adds delay and domain join works.

Related Information

Ensure all permissions are setup correctly as per VMware KB :Joining vCenter Server Appliance or ESXi host into Active Directory domain fails with error: LW_ERROR_LDAP_CONSTRAINT_VIOLATION or LW_ERROR_LDAP_INSUFFICIENT_ACCESS

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
My Workspace ONE Community Forums から VMware Technology Network への移行完了 (76604)

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
ixgben ドライバ 1.7.10 以降を使用している場合の Intel NIC のフラッピング (76251)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Related Versions:

Take Our Survey

Support Assistant