• In the vmdird-syslog.log file, you see entries similar to:
  
  2016-09-21T18:47:48.024511+00:00 err vmdird t@140107551946496: SASLSessionStep: sasl error (-13)(SASL(-13): authentication failure: client evidence does not match what we calculated. Probably a password error)
  2016-09-21T18:47:48.024533+00:00 err vmdird t@140107551946496: VmDirSendLdapResult: Request (96), Error (49), Message ((49)(SASL step failed.)), (0) socket ([17] 10.105.217.85:389<-10.105.212.102:54753)
  2016-09-21T18:47:48.024538+00:00 err vmdird t@140107551946496: Bind Request Failed ([17] 10.105.217.85:389<-10.105.212.102:54753) error 49: Protocol version: 3, Bind DN: "cn=accountname,ou=Computers,dc=vsphere,dc=local", Method: 163
  
  Note: The vmdird-syslog.log file is located at:
  • vCenter Server Appliance with embedded PSC/PSC: /var/log/vmware/vmdird/vmdird-syslog.log
  • Windows installed vCenter Server with embedded PSC/PSC: "%VMWARE_LOG_DIR%"\vmdird\vmdir.log

• vmdir replication may not be working between vCenter with Embedded PSCs/External PSCs - nodes may be XXX changes behind from replication partners' point of view

1) Reset the machine account password manually:

1. In Appliance 
2. In Windows

 Appliance

Windows installed vCenter Server

1. Create a snapshot of the vCenter Server and Platform Services Controller. If you have multiple vCenters with embedded PSCs/PSCs in the SSO domain; ensure all machines in the SSO domain are offline, snapshot them all and if restoring; restore all before powering on any machines to ensure consistency in the case of a revert.
2. Open the elevated command prompt on the vCenter with Embedded PSC/PSC.
3. Run this command:
   
   %VMWARE_CIS_HOME%\vmdird\vdcadmintool.exe
   
   You see these options:
   
   ================================
   Please select:
   0. exit
   1. Test LDAP connectivity
   2. Force start replication cycle
   3. Reset account password
   4. Set log level and mask
   5. Set vmdir state
   ================================
    
4. Select option 3.
5. Enter the user account listed in the vmdir.log file.
   
   Note: This is the machine account in the format FQDN@SSO DOmain.
   
   For example:
   
   [email protected]
   
   As above, you may have to try option 3 several times before you get a password without invalid special characters.
   
    
6. Make note of the generated password.
7. Connect to the vCenter Server or PSC and open regedit.
   
   Note: Before making any registry modifications, ensure that you have a current and valid backup of the registry and the virtual machine. For more information on backing up and restoring the registry, see the Microsoft article 136393.
    
8. Navigate to HLKM\System\CurrentControlset\Services\VMwareDirectoryService\ location.
    
9. Update the password for the key dcAccountPassword.
10. Save the changes and exit.
11. Restart the vCenter Server services. For more information, see Stopping, starting, or restarting VMware vCenter Server 6.x services (2109881).

2) Reset machine account password using dir-cli (versions 6.5 onwards)

1. Login to the machine noted in the vmdird-syslog.log as root user via SSH
2. Run this command to enable access the Bash shell:
   
   shell.set –enabled true
    
3. Type shell and press Enter.
4. Run below command where <Platform Services Controller FQDN> is the FQDN of the vCenter with embedded PSC or PSC of the machine with the error 49 in it's vmdird-syslog.log log:

1. Login to the machine noted in the vmdir.log 
2. Open the elevated command prompt on the vCenter with Embedded PSC/PSC
3. Run below command where <Platform Services Controller FQDN> is the FQDN of the vCenter with embedded PSC or PSC of the machine with the error 49 in it's vmdir.log:

3) Reset machine account password using shell script (Appliance only)

LDAP Error Code 49 : Reset Machine Account Password of vCenter Server Appliance using Shell Script (70756)
 

4) Reset using reset_machine_pw.sh shell script (Built in for version 7.0 only)

1. Take offline snapshots of all vCenters in the SSO domain before proceeding. This means to power off all vCenters in the SSO domain, connect to the ESXi hosts they're placed on and snapshot each of them while in powered off state. If reverting; restore each to snapshot before powering any on. This ensure consistency of the SSO domain.
2. Connect to the vCenter over SSH with root user and type shell to access the bash shell
3. Run the script using the command below - you'll be prompted for the FQDN of the replication partners (vCenters) that you wish to reset the machine account password for and also prompted for SSO admin credentials: