Enhanced Link Mode vCenter 8 Fails

[cbrock01]

I'm currently setting up a lab environment for vCenter 8. I've already had one vCenter instance running for a couple of months and now I'm attempting to build another instance at a separate site. I'm trying to join the new instance to the existing domain, but no matter how I do it, it fails to join and then I have to blow out the new instance and rebuild it. When I attempt to join the domain using the vCenter GUI installer, it fails almost immediately during stage 2 of the installation and doesn't give any information about why it failed.

 

I've also tried deploying the second vCenter instance without linking them in the GUI, and then attempted to repoint the domain using the following command: 

cmsso-util domain-repoint -m -execute --src-emb-admin Administrator --replication-partner-fqdn {FQDN of 1st vCenter} --replication-partner-admin {admin user name of 1st vCenter} --dest-domain-name {domain name of 1st vCenter}

I'm then prompted for the source embedded admin password and the platform services controller admin password. I put these in correctly, the repoint begins, and then fails at "Updating Registry settings". Before I even begin this, I run the same command but with "pre-check" instead of "execute" and it passes the pre-check. 

Has anyone run into an issue like this? I'm not finding much online regarding vCenter 8 and enhanced linked mode and definitely not any troubleshooting steps. 

[bcvmwuser]

Wondering if you ever found the issue. We are hitting the same problem when trying the same thing. 

-------------------------------------------

[noorealam]

Hi @bcvmwuser

Check this KB Article and also check the logs mentioned in KB.

cmsso-util domain-repoint command failed while registering service registrations

Thanks

------------------------------
nalamnalam
------------------------------

[bcvmwuser]

Thank you @noorealam.

However, I ended up figuring it out just a few minutes ago. After much trial and error and many snapshots taken and reverted, I found the log "/var/log/vmware/cloudvm/domain-consolidator-stdout.log" which had errors in it regarding failed authentication to the VMware Directory service. It led me down a path of remembering we altered the default [e-mail] group memberships to disallow it to have access to cryptography for security reasons. Once I reversed those changes and added it back to the default groups. After doing this elm completed without issue. 

It is also interesting the actual "admin" account we created that did have access to manage cryptography didn't work wither, even though it had the "correct" permissions. I assume this is because the [e-mail] account was used to setup the default SSO when deploying the vcenters initially. 

Thank you for the response and hope this helps someone else in the future. 

-------------------------------------------