How to Fix vCenter Domain Authentication Not Working

Help: My vCenter domain authentication not working

Some users reported that after enabling Active Directory domain authentication from the Authentication tab on the Web Console, they cannot log in to vCenter with an Active Directory domain user. Why does the authentication fail?

As VMware stated, users use their user name and password to log in to the default domain. For all other domains, users must include the domain name (user@domain or DOMAIN\user), otherwise the login will fail. And if you are using the vCenter Server Appliance, there might be other problems.

Overall, vCenter authentication errors occur from time to time, today we will focus on how to fix vCenter domain authentication not working issue.

How to fix vCenter domain authentication not working

For all vCenter Single Sign-On deployments, you can change the default identity source. After that change, users can log in to the default identity source with user name and password only.

If you are using the vCenter Server Appliance, and changing the default identity source does not resolve the issue, perform the following additional troubleshooting steps.

1. Synchronize the clocks between the vCenter Server Appliance and the Active Directory domain controllers.

2. Verify that each domain controller has a pointer record (PTR) in the Active Directory domain DNS service.

Verify that the PTR record information for the domain controller matches the DNS name of the controller. When using the vCenter Server Appliance, run the following commands to perform the task:

ⓐ To list the domain controllers, run the following command:

The relevant addresses are in the answer section, as in the following example:

ⓑ For each domain controller, verify forward and reverse resolution by running the following command:

The relevant addresses are in the answer section, as in the following example:

The relevant addresses are in the answer section, as in the following example:

3. If that does not resolve the problem, remove the vCenter Server Appliance from the Active Directory domain and then rejoin the domain.

4. After completing these steps, close all browser sessions connected to the vCenter Server Appliance and restart all services.

Removing vCenter Server Appliance from a specific domain takes a downtime. And to avoid data loss, it's a good idea to take a snapshot or make a virtual machine backup.

Batch backup VMs managed by vCenter before data loss

It is necessary to perform image-based backup of large amounts of VMs managed by vCenter Server, however, vCenter Server does not provide the feature of virtual machine backup. And that makes backup software a commonly accepted choice.

Here I introduce you to a VMware backup software AOMEI Cyber Backup, it enables you to backup multiple VMs either managed by vCenter Server, or on a standalone ESXi host.

✦ Agentless Backup: create complete and independent image-level backup for VMware ESXi and Hyper-V VMs.
✦ Flexible vSphere Backup: batch backup large numbers of VMs managed by vCenter Server, or multiple VMs on a standalone ESXi host.
✦ Multiple Storage Destinations: backup to local drive, or network destinations like NAS.
✦ Automated Execution: create backup schedules to automate backups daily, weekly, monthly.
✦ Email Notification: send email notification when the task is completed or abnormal.
✦ Restore Entire VM: restore instant available VMs from any selected restore points to an original or new location.

AOMEI Cyber Backup supports both paid and free versions of VMware ESXi 6.0 and later versions. Next, I will show you how to batch backup VMs managed by vCenter Server with AOMEI Cyber Backup in 3 simple steps.

You can click the following button to download the 30-day free trial.

*You can choose to install this VM backup software on either Windows or Linux system.

3 Steps to batch backup VMs managed by vCenter Server

1. Bind Devices: Access to AOMEI Cyber Backup web client, navigate to Source Device > VMware > + Add VMware Device to Add vCenter or Standalone ESXi host. And then click … > Bind Device.

2. Create Backup Task: Navigate to Backup Task > + Create New Task, and select VMware ESXi Backup as the Backup Type.

Set the Task Name, Device, Target, Schedule and Cleanup as needed.

• Task Name: you can change the task name or use the default name with an ordinal.
• Device: batch select large numbers of VMs managed by vCenter Server for centralized backup.
• Target: select to back up to a local path, or to a network path like NAS.
• Schedule (optional): perform full, differential, or incremental backup, and automate execution according to the frequency you specified.
• Cleanup (optional): automatically delete the old backup copies that exceed the retention period you specified.

Click Start Backup and select Add the schedule and start backup now, or Add the schedule only. Created backup tasks will be listed and monitored separately for restoring, progress checking and schedule changing.

3. When restoring, you can also restore to new location to create a new VM in the same or another datastore/host directly from the backup, saving the trouble of re-configuring the new VM.

Summary

Despite joining vCenter to AD and configuring Windows authentication as the identity source, you may be still unable to log on to vCenter with “Invalid Credentials” error message in vSphere Client. This article describes the steps to fix the error of vCenter domain authentication not working.