Symptoms:

• Attempting to join an ESXi host or VCSA to the domain fails
• Attempting to add an ldap Identity Source fails
• Attempting to login with a user account fails
• In the security logs of the domain controller you observe the following Credential Validation Error:

VMware vCenter Server 7.0.x
VMware vCenter Server 6.x

Introduced in Windows Server 2012 R2 domain controllers the Protected Users Security Group by design is inherently restrictive.

"Members of this group automatically have non-configurable protections applied to their accounts. Membership in the Protected Users group is meant to be restrictive and proactively secure by default."

Accounts that are members of the Protected Users group that authenticate to a Windows Server 2012 R2 domain are unable to:

• Authenticate with NTLM authentication.

• Use DES or RC4 encryption types in Kerberos pre-authentication.

• Be delegated with unconstrained or constrained delegation.

• Renew the Kerberos TGTs beyond the initial four-hour lifetime.

There is no resolution

Workaround:
Utilize a user account outside of the 'Protected Users' Group

https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group