Removing vCenter from died Active Directory

Tue, 15 Feb 2022 22:21:00 +0000

I lost both of my domain controllers earlier this week, even after I restored one from a VM backup. There was too much corruption. As a result, I rebuilt my domain with new domain controllers, joined all my Windows virtual machines to the new domain, recreated my user accounts, etc. One of the challenges I ran into was getting my vCenter to leave the old domain so it could join the new domain. The old domain was no longer available, so I could not leave it.

When trying to “Leave Active Directory Domain” in the GUI, I got the following error:

ldm client exception: Error trying to leave AD, error code [1332], user [mmattox@ad.support.tools]

vSphere 7 – Certificates with VMCA as Subordinate

Tue, 07 Sep 2021 07:46:00 +0000

For enterprises that need fully trusted SSL certificates for the vSphere 7.0 environment, you have two basic options:

Full Custom Mode: Manually replace all certificates for vCenter and the ESXi hosts with your trusted certificates. Subordinate CA Mode: Use the built-in VMCA service as an official subordinate CA of your existing PKI infrastructure. After the initial configuration, automates the issuing of SSL certs for your vSphere environment. This is the method covered in this blog post. VMware offers two other certificate options: Fully Managed and hybrid mode, for a total of four certificate options. You can find out more about all of them in this VMware blog post.

In a high-security environment, it is very likely the security team will NOT let you configure the vCenter VMCA as a subordinate CA. So, you will be left with the full custom mode if you want 100% of the certificates trusted. However, if you are in a situation where you can configure the VMCA as a subordinate CA, this post is for you!

Note: Before you do this replacement in production, I strongly urge you to set up a test vCenter instance and run this entire procedure. Botched certificate replacements can lead to bad days. And another tip for a lab test is to snapshot the vCenter VM before you try the process. That way, you can easily roll back should things go south.

VCenter on Support Tools

Removing vCenter from died Active Directory

vSphere 7 – Certificates with VMCA as Subordinate