Wednesday 30 November 2016

FSMO Roles-Move and Seize Theory




 Hello Professionals,
FSMO Roles: In previous blog, its explained that what is FSMO role and there importance. Today am doing further practical on FSMO that is how to Seize and Transfer.
When to perform seize and when to transfer.
 Every Forest level Domain controller having all 5 roles and other Domain level, Domain controller having 3 roles.Its very important to place them on correct place other wise there will be different issues in Domain Controller.
Lab Setup: 
Forest Domain Controller: 2003 Standard Edition
Child Domain Controller: 2008R2
Child Domain Controller: 2008R2
Additional Domain Controller: 2012 and 2016
As 2003 is EOL, so today am moving to 2008R2. FSMO roles can be delegate by command as well as GUI from Domain Controllers. Some of organization are delegate FSMO roles in maintenance time of Domain Controller and after maintenance activity roll back the roles to original servers.This is practise to minimize the down time of services and production.
netdom query fsmo is the command to see which server having what type of FSMO Roles. From GUI also you can see the server having what roles are possible.
As the Current server is domain level so having 3 roles and Forest having other 2 roles.




 To view Schema Roles first regsvr32 schmmgmt.dll need to register on command prompt, then add the Active Directory Schema console from mmc.

 Before proceeding the delegate the FSMO roles, its require to connect the destination domain controller from Forest Root DC.
Open Active Directory Domain and Trust,  then click on connect to Domain Controller

  Select the domain controller where you are planning to delegate the roles.


 from here, first operation master need to delegate to destination domain controller.
and further Schema will me moved like this. First register the dll and add the schema from mmc console.


 Then finally login to Destination server and move the schema, because at every role, the wizard will ask to connect the destination domain controller.

then finally, All roles are moved to my 2008R2 server. and i can power off 2003 DC.

Still there are lots of thing to modify on configuration based, will be posting very soon. 
What is the server which was performed for maintenance didnt caem online or due to some un-wanted issue the server got crash. Then FSMO Seize option works here. Basically From Destination server, you need to follow the below command with administrator access.
ntdsutil
roles
connections
connect to server servername


quit


SEIZE INFRASTRUCTURE MASTER
SEIZE RID MASTER
SEIZE PDC
SEIZE SCHEMA MASTER
SEIZE DOMAIN NAMING MASTER
 


and then run forcefull sync command to update the data, as it will take some time to respond and update other domain controllers.
 
comment and share if any query or issue you are facing.We will try our best to solve the case.

Wednesday 9 November 2016

Known Issue and Workaround for Vsphere 5.5

Here are some Knows issue for Vsphere 5.5 with its workaround solutions.

1.   Reinstallation of vCenter Single Sign-On node hangs indefinitely at "Configuration SSO Components.
    You install multiple instances (nodes) of vCenter Single Sign-On 5.5. When you uninstall one of the nodes, The VMware Directory Service, which has been replicated across nodes, is not cleaned up automatically. When you reinstall the node, duplicate VMware Directory Service information prevents the installer from completing the installation and from pointing the node to the existing vCenter Single Sign-On instance. Installation hangs indefinitely.

 Workaround: Change the host name of the vCenter Single Sign-On server and clear out stale Windows registry keys. See the resolution section of VMware Knowledge Base article 2059131(http://kb.vmware.com/kb/2059131).

2.Storage profiles not visible in the vSphere Web client after you install and uninstall vCenter Server
If you uninstall vCenter Server from the Windows control panel item Add/Remove Programs or Programs and Features, Profile-Driven Storage is also uninstalled. When you reinstall vCenter Server, Profile-Driven Storage service is also installed, but you cannot see previously created Storage Profiles in the vSphere Web Client. New Storage Profiles can still be created.

Workaround: To uninstall vCenter Server without uninstalling Profile-Driven Storage, use an MSI command. Then, when you reinstall vCenterServer, either through the installer wizard or from the command line, you can still see previously created Storage Profiles in the vSphere Web Client.

To uninstall vCenter Server, use the following sample command as a model:
msiexec.exe /x vCenter Server Product code
For example:
msiexec.exe /x {E1F05550-4238-4378-87F0-105147A251D9}
The exact product code for vCenter can be obtained from the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VMware vCenter Server

3. Login might fail for Local OS users if vCenter Single Sign-On 5.5 includes more than one node
The Local OS identity source is available after install or upgrade, as follows: * The vCenter Single Sign-On installer adds the Local OS identity source to the vCenter Single Sign-On configuration. If you create more than one node, the Local OS from the primary node displays as an identity source on all other nodes. * If you upgrade a vCenter Single Sign-On High Availability environment, Local OS from the primary node displays as an identity source on all other nodes. However, even though the Local OS from the first node displays as an identity source in secondary nodes, Local OS users from the first node cannot log in on those secondary nodes.

Workaround:None.

4. Installation using Simple Install fails on Windows Server 2008 R2 and Windows 2012 hosts
If you use Simple Install to install vCenter Server and components on a Windows Server 2008 R2 or Windows 2012 host, and the host is configured to use DHCP IP addressing, the installation fails with warning and error messages.

Workaround: Take one of the following actions.
    On a Windows Server 2008 R2 or 2012 host: configure Windows Server to use a static IP and hostname.
    On a Windows Server 2008 R2 host only: map the DHCP IP and hostname to the system's HOST file in the operating system.

5. During vCenter Single Sign-On 5.5 installation, you cannot specify a host name that is different than the FQDN of the machine on which you are installing vCenter Single Sign-On.
The vCenter Single Sign-On installer does not have the option to specify a host name during installation. The installer always uses the FQDN of the machine on which you are installing vCenter Single Sign-On. You cannot use a CNAME instead of the FQDN during installation.

Workaround: None.

6.Installation on Software iSCSI LUN fails with the error Expecting 2 bootbanks, found 0
The full error that accompanies this problem is:
Error (see log for more info):
Expecting 2 bootbanks, found 0.

This problem occurs when the first network adapter is configured to boot from an iBFT iSCSI. The iBFT IP settings are used to configure the VMkernel network port that is created to access the iSCSI boot disk. In this case, the port is the management network port, because the first adapter is used for management traffic.
When the installation is approximately 90 percent complete, the installer reconfigures the management interface with DHCP. As a result, the iBFT IP settings are lost and the TCP connection with the iSCSI boot target breaks.
Workaround: Take one of the following actions:
>    If multiple network adapters are available, use the second network adapter to access the iSCSI boot
     disk.
>    If only one network adapter is available, configure iBFT to use DHCP. The iSCSI target should be on the management network. If the iSCSI target is on a different subnet, the default VMkernel gateway can roError message 25205 appears during installation of vCenter Server on Turkish version of Windows Server
On any Turkish version of Windows Server 2008 or 2012, when you install vCenter Server with the vCenter Server database on the same host machine, Error message 25205 appears.
Workaround: Install and run the vCenter Server database from a remote English version of Windows Serverute both management and iSCSI traffic.

7.Error message 25205 appears during installation of vCenter Server on Turkish version of Windows Server
On any Turkish version of Windows Server 2008 or 2012, when you install vCenter Server with the vCenter Server database on the same host machine, Error message 25205 appears.
Workaround: Install and run the vCenter Server database from a remote English version of Windows Server.


8.  Simple Install checks space requirements only on system drive
Simple Install checks whether enough space is available before it starts the installation. However, it performs the check only if you install on a system drive. If you attempt to install on a non-system drive, the installer does not check whether enough space is available.
Workaround: Check the disk space available on the target drive before installation. The minimum required free space for Simple Install is 10GB. More space is recommended. See the Installation and Setup documentation.


9.If you use preserve VMFS with Auto Deploy Stateless Caching or Auto Deploy Stateful Installs, no core dump partition is created. When you use Auto Deploy for Stateless Caching or Stateful Install on a blank disk, an MSDOS partition table is created. However, no core dump partition is created.

Workaround: When you enable the Stateless Caching or Stateful Install host profile option, select Overwrite VMFS, even when you install on a blank disk. When you do so, a 2.5GB coredump partition is created.

10.If the vCenter Single Sign-On installation fails and rolls back, the vCenter Server Java Components (JRE) and vCenter tc Server component remain installed.When the Single Sign-On installation is canceled or fails, the installation rolls back to the pre-installation state, and a message states that the system was not modified. However, the vCenter Server Java Components (JRE) and vCenter tc Server component are still installed.

Workaround: Remove the components manually in the Windows Programs and Feature control panel.


11.vSphere Authentication Proxy installation fails if the installation path contains non-ASCII characters
If the installation path contains non-ASCII characters, the vSphere Authentication Proxy installation fails with the error message Error 29106. Unknown Error.

Workaround: Make sure the installation path contains only ASCII characters.


12. Installation of vCenter Server and related components fails if the user name of the logged-in user contains non-ASCII characters. If the user name of the user who is currently logged in contains non-ASCII characters, installation of vCenter Server, vCenter Inventory Server, vCenter Single Sign-On, or the vSphere Web Client fails with the error message: The user name contains non-ASCII characters. Please log in with a user name that contains only ASCII characters.

Workaround: Log in with a user name that does not contain non-ASCII characters and retry the installation.

13.During scripted installation, ESXi is installed on an SSD even though the --ignoressd option is used with the installorupgrade command
In ESXi 5.5, the --ignoressd option is not supported with the installorupgrade command. If you use the --ignoressd option with the installorupgrade command, the installer displays a warning that this is an invalid combination. The installer continues to install ESXi on the SSD instead of stopping the installation and displaying an error message.

Workaround: To use the --ignoressd option in a scripted installation of ESXi, use the install command instead of the installorupgrade command.

14.The autoPartition boot option might partition SSDs unintentionally
In Visor (an ESXi dd image written to a device), the autoPartition boot option is set to TRUE by default. This setting causes all blank local disks, including SSDs that you might have intended to use with vFlash and Virtual SAN, to be partitioned.

Workaround: Add skipPartitioningSsds=TRUE to the boot options line.

15.During vCenter Server Simple Install, a dialog box displays a warning that a script is causing the browser to run slowly.The vCenter Server Simple Install option takes a significant amount of time to install or upgrade all required vCenter Server components. This might cause the Internet Explorer browser process that runs the vCenter Server installer autorun screen to display the following warning message:
A script on this page is causing your browser to run slowly. If it continues to run, your computer might become unresponsive. Do you want to abort the script?

The warning dialog is displayed when the installation takes longer than the time set by the Windows registry entry: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles\MaxScriptStatements

This issue has been observed most frequently on the Windows Server 2012 operating system.
Workaround: Click No in the warning message, or set the value for the MaxScriptStatements registry entry to 0xffffffff.


16.Delay in Auto Deploy cache purging might apply a host profile that has been deleted
After you delete a host profile, it is not immediately purged from the Auto Deploy. As long as the host profile is persisted in the cache, Auto Deploy continues to apply the host profile. Any rules that apply the profile fail only after the profile is purged from the cache.

Workaround: You can determine whether any rules use deleted host profiles by using the Get-DeployRuleSet PowerCLI cmdlet. The cmdlet shows the string deleted in the rule's itemlist. You can then run the Remove-DeployRule cmdlet to remove the rule.

17.Applying host profile that is set up to use Auto Deploy with stateless caching fails if ESX is installed on the selected disk.You use host profiles to set up Auto Deploy with stateless caching enabled. In the host profile, you select a disk on which a version of ESX (not ESXi) is installed. When you apply the host profile, an error that includes the following text appears.
Expecting 2 bootbanks, found 0

Workaround: Select a different disk to use for stateless caching, or remove the ESX software from the disk. If you remove the ESX software, it becomes unavailable.

18.Installing or booting ESXi version 5.5.0 fails on servers from Oracle America (Sun) vendors
When you perform a fresh ESXi version 5.5.0 installation or boot an existing ESXi version 5.5.0 installation on servers from Oracle America (Sun) vendors, the server console displays a blank screen during the installation process or when the existing ESXi 5.5.0 build boots. This happens because servers from Oracle America (Sun) vendors have a HEADLESS flag set in the ACPI FADT table, even though they are not headless platforms.
Workaround: When you install or boot ESXi 5.5.0, pass the boot option ignoreHeadless="TRUE"

19.If you use ESXLIC commands to upgrade an ESXi host with less than 4GB physical RAM, the upgrade succeeds, but some ESXi operations fail upon reboot
ESXi 5.5 requires a minimum of 4GB of physical RAM. The ESXCLI command-line interface does not perform a pre-upgrade check for the required 4GB of memory. You successfully upgrade a host with insufficient memory with ESXCLI, but when you boot the upgraded ESXi 5.5 host with less than 4GB RAM, some operations might fail.

Workaround: None. Verify that the ESXi host has more than 4GB of physical RAM before the upgrade to version 5.5.

20.Upgrade to vCenter Server 5.5 does not detect expired SSL certificates
When you use Simple Install to upgrade to vCenter Server 5.5, the installer does not detect any expired SSL certificates.
If you upgrade from 5.1.x to 5.5 using the individual installers in a Custom Install, only the vSphere Web Client detects expired SSL certificates and stops the installation. vCenter Single Sign-On displays a generic warning message to verify the validity of SSL certificates. The vCenter Inventory Service and vCenter Server individual installers do not detect expired SSL certificates.

Workaround: Before you start the upgrade to vCenter Server 5.5, using either Simple Install or the individual installers in a Custom Install, check the validity of the SSL certificates of vCenter Single Sign-On, the vSphere Web Client, vCenter Inventory Service, and vCenter Server. Replace any expired SSL certificates with valid certificates before starting the upgrade process.

21.After upgrade from vCenter Server Appliance 5.0.x to 5.5, vCenter Server fails to start if an external vCenter Single Sign-On is used
If the user chooses to use an external vCenter Single Sign-On instance while upgrading the vCenter Server Appliance from 5.0.x to 5.5, the vCenter Server fails to start after the upgrade. In the appliance management interface, the vCenter Single Sign-On is listed as not configured.
Workaround: Perform the following steps:
    In a Web browser, open the vCenter Server Appliance management interface (https://appliance-address:5480).
    On the vCenter Server/Summary page, click the Stop Server button.
    On the vCenter Server/SSO page, complete the form with the appropriate settings, and click Save Settings.
    Return to the Summary page and click Start Server


22.After you upgrade vCenter Single Sign-On 5.1.x in a high availability deployment with a load balancer to version 5.5, you must reconfigure the load balancer
During the upgrade from vCenter Single Sign-On 5.1 to 5.5, the file server.xml is migrated, but you must update the file manually after the upgrade.
Workaround: See the topic Reconfigure the Load Balancer After Upgrading a vCenter Single Sign-On High Availability Deployment to Version 5.5 in the vSphere Upgrade documentation.

23.vCenter Server 5.1 not visible after you upgrade vSphere Web Client and vCenter Single Sign-On to version 5.5
Suppose you upgrade vSphere Single Sign-On and the vSphere Web Client from version 5.1 to version 5.5, but you do not upgrade the vCenter Server system. If you log in to the vSphere Web Client after the upgrade, vCenter Server system version 5.1 is not visible. This is a problem only for the Windows upgrade, and not when you upgrade vCenter Server Appliance.

Workaround: Restart the vCenter Server system and the vSphere Inventory service (services.msc). To see the vCenter Server 5.1 inventory, log in as admin@System-Domain. See VMware Knowledge Base article 1003895

24.The VMware VirtualCenter Server service might not start after you upgrade vCenter Server from version 5.0 Update 2 to version 5.5

Workaround: Start the VMware VirtualCenter Server service manually:

    From the Windows Start menu, open the Administrative Tools control panel item.
    Select Services.
    Right-click VMware VirtualCenter Server and select Start

25.When you use ESXCLI to upgrade an ESXi 4.x or 5.0.x host to version 5.1 or 5.5, the vMotion and Fault Tolerance Logging (FT Logging) settings of any VMKernel port group are lost after the upgrade
If you use the command esxcli software profile update <options> to upgrade an ESXi 4.x or 5.0.x host to version 5.1 or 5.5, the upgrade succeeds, but the vMotion and FT Logging settings of any VMkernel port group are lost. As a result, vMotion and FT Logging are restored to the default setting (disabled).

Workaround: Perform an interactive or scripted upgrade, or use vSphere Update Manager to upgrade hosts. If you use the esxcli command, apply vMotion and FT Logging settings manually to the affected VMkernel port group after the upgrade.

26.When you upgrade vSphere 5.0.x or earlier to version 5.5, system resource allocation values that were set manually are reset to the default value
In vSphere 5.0.x and earlier, you modify settings in the system resource allocation user interface as a temporary workaround. You cannot reset the value for these settings to the default without completely reinstalling ESXi. In vSphere 5.1 and later, the system behavior changes, so that preserving custom system resource allocation settings might result in values that are not safe to use. The upgrade resets all such values.

Workaround: None.

28.Networking is lost after you upgrade the vCenter Server Appliance, if the existing vCenter Server Appliance has a static IP configuration and the existing vCenter Server Appliance and the upgraded vCenter Server Appliance are in different subnets
Networking is lost after you upgrade a vCenter Server Appliance configured with both of the following conditions:
   a. The existing vCenter Server Appliance has a static IP configuration.
    b. The existing vCenter Server Appliance and the upgraded vCenter Server Appliance are in different subnets.
Workaround: To restore networking:
    Log in to the vCenter Server Appliance through the virtual machine console.
    Run /opt/vmware/share/vami/vami_config_net to reconfigure networking.

29.Attempts to upgrade the vSphere Web Client to version 5.5 results in warning message: Error: 29108
During the upgrade of the vSphere Web Client to version 5.5, the following warning message is displayed: Error: 29108. The unregistration of the service or Solution user failed.. This error occurs because the installer is unable to remove the application user programmatically.

Workaround:
   a.  Record the exact vSphere Web Client solution user named in the warning message.
    b. Click OK to dismiss the warning message and complete the upgrade to version 5.5 of the vSphere
        Web Client.
  c.   Log in to the vSphere Web Client as the Single Sign-On administrator
  d.  In Administration, under Single Sign-On, click Users and Groups, and click the Application Users tab.
  e. To remove the solution the application user named in the warning message, select the row for that user and click Delete.

30.IPv6 settings of virtual NIC vmk0 are not retained after upgrade from ESX 4.x to ESXi 5.5
When you upgrade an ESX 4.x host with IPv6 enabled to ESXi 5.5 by using the --forcemigrate option, the IPv6 address of virtual NIC vmk0 is not retained after the upgrade.
Workaround: None.

31.The vSphere Web Client service does not start after upgrade of the vCenter Server Appliance
When you upgrade the vCenter Server appliance from version 5.0 or 5.1 to version 5.5, the vSphere Web Client service does not start and the following messages appear in the Virgo Server log:
[ERROR] startup-tracker org.eclipse.virgo.medic.eventlog.default KE0004E Kernel failed to start within 300 seconds.
[INFO ] startup-tracker org.eclipse.virgo.medic.eventlog.default KE0011I Immediate shutdown initiated.

Workaround: Start the vSphere Web Client service by using the vCenter Server Appliance management interface.

32.Updated Error after switchover/failover on systems upgraded from vSphere 5.1U1a to vSphere 5.5 that use vCenter Heartbeat. An environment starts with the following configuration: vCenter Server 5.1U1a with vCenter Single Sign-On, Inventory Service and the vSphere Web Client, plus vCenter Heartbeat 6.5U1. You upgrade to vCenter Server 5.5, and upgrade vCenter Single Sign-On, Inventory Service and the vSphere Web Client at the same time. You upgrade vCenter Heartbeat to version 6.6.
All the VMware components and services start successfully on the primary/active node. If the primary node goes down and you activate the secondary node, the following error appears in the vpxd log when the vCenter Server service starts on the secondary/active node:
Unable to create SSO facade: Invalid response code: 404 Not Found. The vpxd service does not start on the secondary node.
Workaround: If you install the new versions of vCenter Server and vCenter Heartbeat instead of performing an upgrade, the second node starts up as expected. If you must upgrade Single Sign-On, follow the procedures listed in the Knowledge Base article Upgrading Single-Sign On 5.1 to 5.5 when vCenter Server Heartbeat is Installed(http://kb.vmware.com/kb/2059820).

33.Error 29107 appears during vSphere Web Client upgrade from 5.1U1a to 5.5
During an upgrade of a vSphere Web Client from version 5.1 Update U1a to version 5.5, Error 29107 appears if the vCenter Single Sign-On service that was in use before the upgrade is configured as High Availability Single Sign-On.
Workaround: Perform the upgrade again. You can run the installer and select Custom Install to upgrade only the vSphere Web Client.

34.If Active Directory services and vCenter services are in different locations, a login by a user who belongs to over 500 groups might take a long time
Your environment uses an Active Directory setup. This setup is in a different location from vCenter Server and its services. As a result, when a user who belongs to over 500 Active Directory groups logs in with the vSphere Web Client, login might take 10-20 minutes. With the vSphere Client, login for that user might time out.

Workaround: Change your setup so the Active Directory services and the vCenter Server system are in the same location, or log in as a user who does not belong to so many Active Directory groups.

35.Auto-discovery of Active Directory settings no longer supported with vCenter Single Sign-On 5.5
The vSphere 5.1 vCenter Single Sign-On version included an autodiscovery feature. That feature was removed from the vSphere 5.5 vCenter Single Sign-On service.

Workaround: Log in to vCenter Single Sign-On from the vSphere Web Client as a user with vCenter Single Sign-On administrator privileges and add the identity source manually. By default, administrator@vsphere.local has vCenter Single Sign-On administrator privileges.

36.After upgrade, domain administrators, who are part of the local administrators group, cannot log in to vCenter Server.In your vSphere 5.1 environment, you gave permissions to the local administrators group, which implicitly includes the domain administrator group. You can log in to vCenter Server 5.1 as a member of the domain administrator group. However, when you upgrade to vSphere 5.5, the domain administrator users no longer have the permissions to log in to vCenter Server. Permissions for local users are maintained after the upgrade.

Workaround: The simplest solution is to log in to vCenter Server as administrator@vsphere.local and to assign permissions directly to the domain administrators group. If other local users who were not inside a subdomain had permissions to manage to vCenter Server users before the upgrade, those users can also log in to vCenter Server and assign permissions to the domain administrators group or any other group.

37.vCenter Single Sign-On installation fails on Windows Server 2008 SP1
When you attempt to install vCenter Single Sign-On on Windows 2008 SP1 (64 bit), the following warning appears:
This application is only supported on windows server 2008 64bit, or higher. Make sure windows is not running as domain controller.
Installation does not complete.

Workaround: None. Install vCenter Single Sign-On on a Windows 2008 SP2 (64 bit) system.

38.No error occurs when you replace the certificate for a service with a certificate already in use by a different service. If you are using the Certificate Automation Tool to replace certificates, and you respond to the prompts by replacing an existing certificate with a certificate that is already in use by a different service, the tool does not display an error message. The tool proceeds with the replacement. Because each service must have a unique certificate in the vCenter installation on Windows, authentication does not work properly.

Workaround: None. Keep track of the certificates that you are using for the different services

39. Cannot change the password of administrator@vsphere.local from the vSphere Web Client pulldown menu. When you log in to the vCenter Single Sign-On server from the vSphere Web Client, you can perform a password change from the pulldown menu. When you log in as administrator@vsphere.local the Change Password option is greyed out.

Workaround:

    Select the Manage tab, and select vCenter Single Sign-On > Users and Groups.
    Right-click the administrator user and click Edit User.
    Change the password.

40.Login with vCenter Single Sign-On might require inclusion of domain name
In vSphere 5.5, vCenter Single Sign-On no longer supports multiple default domains. This might cause problems for users who attempt to log in to a vCenter Server system that is installed on Windows, or for users who log in to the vCenter Server Appliance.

Workaround: Include the domain prefix with the user name when you log in to a nondefault domain. For example, the user root on the local operating system can log in as localos\root. The user user1 in the domain DOMAIN1 can log in as DOMAIN1\user1.
This behavior is not considered a bug, but included in the release notes for completeness.

41.vCenter Single Sign-On installation fails if the destination folder includes non-ASCII or high ASCII characters. If you change the destination folder for vCenter Single Sign-On during installation, and if the new destination folder that you select includes non-ASCII or high ASCII characters, no warning appears but installation fails.

Workaround: Select destination folders that contain ASCII characters. Special characters are not allowed and generate the error listed in the next known issue.

42.vCenter Single Sign-On fails if the installation folder includes special characters
If you attempt to install vCenter Single Sign-On in a custom location, and the destination folder name includes characters such as percent (%) or ampersand (&), the installation fails. An error message similar to the following appears:
Error 20020. Failed to update values in server.xml file

Workaround: None. See the vSphere Installation and Setup documentation for a complete list of disallowed characters.

43.Warning during vCenter Single Sign-On installation on virtual machine with multiple network interfaces
You install vCenter Single Sign-On in an environment with multiple network interfaces. One or more of the network interfaces in the environment cannot be resolved with DNS. When the vCenter Single Sign-On installer performs the prerequisite check, a warning that is similar to the following appears:
DNS resolved IP(<ip_address_1>) does not match the machine reported IP(<ip_address_2>). Certificates will use the machine ip instead of FQDN. It is recommended that you have a static IP address for this to work correctly.

Workaround: If both the forward DNS lookup and the reverse DNS lookup for the primary interface are correct, you can ignore the warning and proceed with the installation.


44. An ESXi host stops responding after being added to vCenter Server by its IPv6 address
When you add an ESXi host to vCenter Server by IPv6 link-local address of the form fe80::/64, within a short time the host name becomes dimmed and the host stops responding to vCenter Server.

Workaround: Use a valid IPv6 address that is not a link-local address.

45. The vSphere Web Client lets you configure more virtual functions than are supported by the physical NIC and does not display an error message. In the SR-IOV settings of a physical adapter, you can configure more virtual functions than are supported by the adapter. For example, you can configure 100 virtual functions on a NIC that supports only 23, and no error message appears. A message prompts you to reboot the host so that the SR-IOV settings are applied. After the host reboots, the NIC is configured with as many virtual functions as the adapter supports, or 23 in this example. The message that prompts you to reboot the host persists when it should not appear.

Workaround: None

46.Attempts to name a Link Aggregation Group (LAG) port by using surrogate pair characters fails
In the vSphere Web Client, if you try to rename a LAG port and the new name contains surrogate pair characters, the following error message appears: The port name is not valid. Specify a valid port name. Surrogate pair is a pair of 16-bit values that UTF-16 uses to represent characters that require more than 16 bits.

Workaround: Do not use surrogate pair characters when you name LAG ports.

47. The ESXi Dump Collector fails to send the ESXi core file to the remote server
The ESXi Dump Collector fails to send the ESXi core file if the VMkernel adapter that handles the traffic of the dump collector is configured to a distributed port group that has a link aggregation group (LAG) set as the active uplink. An LACP port channel is configured on the physical switch.

Workaround: Perform one of the following workarounds:

   a. Use a vSphere Standard Switch to configure the VMkernel adapter that handles the traffic for the ESXi Dump Collector with the remote server.
   b. Use standalone uplinks to handle the traffic for the distributed port group where the VMkernel adapter is configured.

48. http://kb.vmware.com/kb/2044993

49.When you try to deploy a virtual machine on a vSphere Distributed Switch, the error message no free port is available in distributed_switch_name might appear although the switch has free ports
When you try to deploy a virtual machine on a vSphere Distributed Switch, the error message no free port is available in distributed_switch_name might appear although the switch has many free ports. vCenter Server handles race conditions incorrectly when reserving and deleting distributed ports. This issue causes vCenter Server to decide that no ports of the distributed switch are available if the first available port is being deleted but is not deleted yet. For example, vCenter Server deletes a port when a host disconnects or enters maintenance mode, or when a virtual machine is reconfigured.

Workaround: Wait for several minutes and redeploy the virtual machine. This time the race condition might not occur.

50.If you change the number of ports that a vSphere Standard Switch or vSphere Distributed Switch has on a host by using the vSphere Client, the change is not saved, even after a reboot. If you change the number of ports that a vSphere Standard Switch or vSphere Distributed Switch has on an ESXi 5.5 host by using the vSphere Client, the number of ports does not change even after you reboot the host.

When a host that runs ESXi 5.5 is rebooted, it dynamically scales up or down the ports of virtual switches. The number of ports is based on the number of virtual machines that the host can run. You do not have to configure the number of switch ports on such hosts.

Workaround: None in the vSphere Client.


51. Host Profile remediation fails with vSphere Distributed Switch
Remediation errors might occur when applying a Host Profile with a vSphere Distributed Switch and a virtual machine with Fault Tolerance is in a powered off state on a host that uses the distributed switch in that Host Profile.
Workaround: Move the powered off virtual machines to another host in order for the Host Profile to succeed.

52. Noncompliance messages appear after using Auto Deploy for stateless caching or stateful installs to USB
After a host profile is edited to enable stateless caching to the USB disk on the host, the host profile receives compliance errors when attempting to remidiate. The host is rebooted and caching finishes. After checking compliance, the following compliance error is received:
Host state does not match specification

Workaround: No workaround is required. The message is incorrect.

53. Host profile receives firewall settings compliance errors when you apply ESX 4.0 or ESX 4.1 profile to ESXi 5.5 host. If you extract a host profile from an ESX 4.0 or ESX 4.1 host and attempt to apply it to an ESXi 5.5 host, the profile remediation succeeds. The compliance check receives firewall settings errors that include the following:
Ruleset LDAP not found
Ruleset LDAPS not found
Ruleset TSM not found
Ruleset VCB not found
Ruleset activeDirectorKerberos not found

Workaround: No workaround is required. This is expected because the firewall settings for an ESX 4.0 or ESX 4.1 host are different from those for an ESXi 5.5 host.


54.New Changing BIOS device settings for an ESXi host might result in invalid device names
Changing a BIOS device setting on an ESXi host might result in invalid device names if the change causes a shift in the <segment:bus:device:function> values assigned to devices. For example, enabling a previously-disabled integrated NIC might shift the <segment:bus:device:function> values assigned to other PCI devices, causing ESXi to change the names assigned to these NICs. Unlike previous versions of ESXi, ESXi 5.5 attempts to preserve devices names through <segment:bus:device:function> changes if the host BIOS provides specific device location information. Due to a bug in this feature, invalid names such as vmhba1 and vmnic32 are sometimes generated.

Workaround: Rebooting the ESXi host once or twice might clear the invalid device names and restore the original names. Do not run an ESXi host with invalid device names in production.

55.Storage profiles without storage capabilities might be missing after you upgrade vCenter Server to version
    After you upgrade to vCenter Server 5.5, storage profiles that you created with an earlier version of
   vCenter Server are not visible in the vSphere Web Client. This problem affects only storage profiles that
    do not have any storage capabilities attached.

    Workaround: Before you perform an upgrade, attach storage capabilities to the storage profiles that need to be available in vCenter Server 5.5. After the upgrade, the existing storage capabilities are converted into tags in the Legacy User Label category, and the storage profiles are converted into storage policies referencing these tags.

56. The VMware vSphere Web Client service does not start on Turkish versions of Windows Server 2008 or Windows Server 2012.     When you install the server component of the vSphere Web Client on a Turkish version of Windows Server 2008 or Windows Server 2012, the service does not start after the installation finishes.
Workaround: Install the vSphere Web Client on a version of Windows Server 2008 or Windows Server 2012 that is in another language.


57.The vSphere Web Client displays error messages in zh, zh-hans, and zh-hant locales. If the browser locale has been set to Simplified Chinese or Traditional Chinese, the vSphere Web Client might display errors when you perform some operations, such as managing objects, licensing, and datacenter creation. In the Recent Tasks pane, the following message might appear: Unable to create the managed object for <string>. Additional error messages appear as notifications. The problem occurs in Internet Explorer, Google Chrome, and Mozilla Firefox.
Workaround: Change the browser locale and restart the browser.


58.You cannot access the vSphere Web Client by using some Firefox versions with certain operating systems in an IPv6 network environment. In the Windows and Linux versions of Firefox 18.0.2, you cannot access URLs in an IPv6 environment. On some supported Linux distribution, such as SLES/SLED 11, you cannot use the bundled Firefox 10.x browser, because the browser does not accept SSL certificates for IPv6 addresses. For information about this third-party issue, see Mozilla bug 633001.

 Workaround: Use other supported browsers such as Google Chrome or Internet Explorer.


59.Error messages appear when you attempt to log in to the vSphere Web Client by using Google Chrome on Mac OS X 10.7.x in certain language and format locales. You encounter Error 2007 and Error 1009 and cannot log in when you use Google Chrome 23 running on Mac OS X 10.7.x. The problem is present if the operating system language and format are set to French, German, Japanese, Korean, or Russian. For the problem to appear, Google Chrome must be installed before switching the operating system locale and the browser must use Flash Player 11.5.31.5 or 11.5.31.139.
Workaround: Perform one of the following tasks:
        a. Change the Flash Player version to 11.5.502.136 or 11.5.31.137.
        b. Switch to English locale and restart the browser.
        c. Switch to English locale, uninstall Chrome, switch back to the locale of choice, and reinstall Chrome.


60. New I/O memory management unit (IOMMU) faults might appear when the debug direct memory access (DMA) mapper is enabled.The debug mapper places devices in IOMMU domains to help catch device memory accesses to addresses that have not been explicitly mapped. On some HP systems with old firmware, IOMMU faults might appear.
Workaround: Download firmware upgrades from the HP Web site and apply them.
        a.Upgrade the firmware of the HP iLO2 controller.
        b.Version 2.07, released in August 2011, resolves the problem.
        c.Upgrade the firmware of the HP Smart Array.
        d.For the HP Smart Array P410, version 5.14, released in January 2012, resolves the problem.


61.Sensor values for Fan, Power Supply, Voltage, and Current sensors appear under the Other group of the vCenter Server Hardware Status Tab.Some sensor values are listed in the Other group instead of the respective categorized group.
Workaround: None.


62.Under certain conditions, a virtual machine does not reset despite the appState being appStateNeedReset
    A virtual machine is not reset if the needReset appstate is issued using the Application Monitoring GuestSDK when the virtual machine is on a standalone host and the host is moved to a cluster which has VM and App Monitoring enabled. This could also occur if the FDM process restarts on the host while the needReset request is pending. For example this error can occur when reconfiguring vSphere HA or if the service crashes after a needReset state has been issued for a virtual machine using the Application Monitoring GuestSDK.

 Workaround: Trigger a blank Reconfigure cluster task for the vSphere HA cluster containing the hosts. The virtual machine's needReset state is picked up by the FDM on the host, which resets the virtual machine. In the vSphere Web Client go to the Edit Cluster Settings panel and click Edit. Press OK on the Cluster Settings panel without changing anything on the cluster. This triggers a blank Reconfigure cluster task.

63. If vSphere HA fails to restart a virtual machine due to an anti-affinity constraint, no re-attempt is made if you change the vm-vm anti-affinity rule or remove it.
Workaround: The vSphere HA master host reattempts placing a virtual machine waiting for resources after the unreserved capacity in the cluster is increased. To increase this capacity, power off a virtual machine, migrate it to another cluster using vMotion, then
       a. bring back on-line a failed host, or
       b.add another host to the cluster, or
       c. reduce the resources reserved by any of the powered-on virtual machines.

64.vSphere HA might fail to restart a virtual machine with a vSphere Flash Read Cache reservation
    When a virtual machine with a vSphere Flash Read Cache reservation is powered on, the host it resides on uses some normal (RAM) memory to manage this flash reservation. If sufficient memory is not available, then the virtual machine power on fails. vSphere HA retries such failed power on operations but only four more times. If the fifth power on attempt fails, vSphere HA issues an event reporting that the maximum number of restart attempts has been reached.
    Note: To list the vSphere HA issued events, you can search the event history for the phrase "vSphere HA".
 Workaround: If vSphere HA fails to restart a virtual machine and you observe a vSphere HA event reporting that the maximum number of attempts have been made to restart it, attempt to power on the virtual machine manually on one of the hosts. If the power on operation fails and a reason is given, address that issue.
However, if this power on task fails for an unexplained reason or if the task error stack reports that the vSphere Flash Read Cache cannot be attached, either try another host or reduce the memory needs of the vSphere Flash Read Cache and try again. You can do this by either
       a. configuring a larger vSphere Flash Read Cache block size for the virtual machine or another virtual machine running on the same host, or
       b. significantly reducing the vSphere Flash Read Cache reservation of one or more of these virtual machines.


65. If you select an ESX/ESXi 4.0 or 4.1 host in a vSphere HA cluster to fail over a virtual machine, the virtual machine might not restart as expected. When vSphere HA restarts a virtual machine on an ESX/ESXi 4.0 or 4.1 host that is different from the original host the virtual machine was running on, a query is issued that is not answered. The virtual machine is not powered on on the new host until you answer the query manually from the vSphere Client.

Workaround: Answer the query from the vSphere Client. Alternatively, you can wait for a timeout (15 minutes by default), and vSphere HA attempts to restart the virtual machine on a different host. If the host is running ESX/ESXi 5.0 or later, the virtual machine is restarted.

66.  A successful Storage vMotion operation in a vSphere HA cluster might result in an orphaned virtual machine.After you migrate a virtual machine with Storage vMotion in a vSphere HA cluster, an orphaned virtual machine with the same name might remain in the vCenter Server inventory. This error can occur if vSphere HA attempts to restart the virtual machine that is being migrated, before the Storage vMotion workflow finishes. The attempt can be triggered in situations such as the following:
       a. The master host detects a possible failure impacting the virtual machine, such as a network
           interruption.
       b. In an environment without Virtual SAN, the master hosts regains access to the virtual machine
          datastore.
        In an environment with Virtual SAN, the master host detects a change in Virtual SAN object accessibility. For example, the host has recently rejoined the Virtual SAN network after a network partition.

    Workaround: Delete the orphaned virtual machine.


67.  Changing datastores through migration is not allowed if the number of virtual disks is greater than 64
    Storage vMotion and vMotion without shared storage support migration of a virtual machine with up to 64 virtual disks. If the number of virtual disks to be moved is greater than 64, the migration operation is not allowed. However, if you use Storage vMotion to selectively move less than 64 disks or to move only the home directory of the virtual machine, the operation succeeds even for the virtual machine with the maximum supported number of virtual disks.
Workaround:
        For Storage vMotion, perform multiple migrations, each with up to 64 disks. Use the Advanced option on the Migrate virtual machine wizard to select disks to migrate and to specify the datastore location.
        For vMotion without shared storage, power off the virtual machine to perform migration.

68. Unable to add a host with IvyBridge-EP or IvyBridge-EX processors to an Intel IvyBridge Generation EVC Cluster.When you attempt to add a host with IvyBridge-EP or IvyBridge-EX processors to an EVC Cluster with the Intel IvyBridge Generation EVC mode enabled, you see an error message stating that necessary CPU features are missing from the host. The host cannot be added to the cluster.

    Workaround: None.

69.Virtual machine drag and drop is not supported across hosts
    You use the vSphere Web Client and attempt to drag and drop a virtual machine from one host to another. A red X indicates that drag and drop is not supported.

Workaround: Use the Migrate VM action or right-click the virtual machine and select Move to to start the migration wizard.


70. Attempts to increase the size of a virtual disk on a running virtual machine fail with an error
    If you increase the size of a virtual disk when the virtual machine is running, the operation might fail with the following error:
    This operation is not supported for this device type.
    The failure might occur if you are extending the disk to the size of 2TB or larger. The hot-extend operation supports increasing the disk size to only 2TB or less. SATA virtual disks do not support the hot-extend operation no matter what their size is.

 Workaround: Power off the virtual machine to extend the virtual disk to 2TB or larger.


71. Virtual machines with Windows 7 Enterprise 64-bit guest operating systems in the French locale experience problems during clone operations
    If you have a cloned Windows 7 Enterprise 64-bit virtual machine that is running in the French locale, the virtual machine disconnects from the network and the customization specification is not applied. This issue appears when the virtual machine is running on an ESXi 5.1 host and you clone it to ESXi 5.5 and upgrade the VMware Tools version to the latest version available with the 5.5 host.

    Workaround: Upgrade the virtual machine compatibility to ESXi 5.5 and later before you upgrade to the latest available version of VMware Tools.



72. Error message appears and no vCenter Server instances are available in the vSphere Web Client inventory after you log in You might encounter this problem when the vCenter Server instance is managing an inventory that is too large and operating under a heavy load.

    Workaround: Log out and log in to the vSphere Web Client. If this does not resolve the problem, verify that your vSphere environment is running within the recommended configuration maximums.



73. vCenter Server Appliance checks user permissions based on case-insensitive user name matching
    In previous vSphere releases, the vCenter Server Appliance used case-sensitive matching for user names when checking user permissions. In the vSphere 5.5 release, the vCenter Server Appliance uses case-insensitive matching for user names when checking permissions. This means that two users whose user names differ only in case (for example, User1 and user1) are treated as the same user when vCenter Server checks permissions.

    Workaround: If your vCenter Server Appliance has users whose names differ only in case, rename at least one of the users, and reassign permissions to the renamed users.


74. Default folder names generated by the vCenter Server Appliance do not reflect the browser's language setting.When you access the vCenter Server Appliance using the vSphere Web Client, default folder names generated by the server, such as Discovered Virtual Machines, do not reflect the browser's language setting.

 Workaround: Edit the vpxd locale setting:
       a. Select the vCenter Server instance in the vSphere Web Client inventory.
       b. Click the Manage tab.
       c. Click Advanced Settings.
       d. Click Edit.
       e. In the vpxd.locale text box, type the locale code.

        Valid options include de, en, fr, ja, ko, and zh_CN.
        Click OK.
        1.Restart vCenter Server:
        2.  Log in to the vCenter Server Appliance configuration interface at https://hostname:5480.
        3.   On the vCenter Server tab, select Summary.
        4.    Click Stop vCenter.
        5.    Click Start vCenter.

Reference from Vmware Blog

 

Active Directory Domain and Trust Issue-1

                                                         



Issue: I got this issue once i tried to access Root DC from Child DC. Attached screen shot here to get more clearance.
Solution: To overcome from this problem, first i viewed the log on problem server (which is 2012 R2) and i found multiple error related to time sync, replication failure, LDAP authentication error and KDC error.
 Basically this problem comes most often when your other DC's are not able to communicate with Root DC.
To fix the issue i Stop the KDC service on problem server.

The KDC is a process that provides two services in AD Environment:
 1. Ticket-Granting Service : This service issues tickets for connection to computers in domain. if clients want access to a computer, then  it first connect the ticket-granting service in the target computer's domain, and ask for a ticket to the computer(as authentication ). it can be reused. The same happen for all computer at firt time once it being accessed by any other device or service or client

2.Authentication Service: This service give raise ticket as authentication in domain as well as if this is in trusted domain.Before accessing a computer this ticket should be come as authentication permission.Once this is permitted , the computer can be accessed until this not expire.

 In this issue, most of event are related to KDC service error, So i tried with KDC service start and stop.

This KDC service can be stopped in 2003 server by support tools but in 2012 its upgraded version and inbuilt with AD services so i run Klist help first to see more option.

 Here lots of option so before proceeding with any thing i stopped KDC on problem server
net stop KDC as administrative privilege and then 
Reset computer account from Root DC.


Run the command to purge the database, as in the event its was KDC error with computer account.
Then finally i run sync command to replicate all on Root DC.
and i got Domain and Trust Console fine.
There are couple other solution which work in different cases like
1. Restart Netlogon
2. In TCP/IP settings allow all conenction from Filterring options
3. See if port 80 is connected

Its depend on infra to infra. So better to check settings and configuration before proceeding to any solution.