If I join esxi to an Active Directory domain, how does it choose which DC to authenticate to?

Question

I'm familiar to vSphere and large installations, and not at all familiar with the free products.

Topology & configuration

We have some branch offices that use ESXi and have a DC resident on them, as a virtualized host. This is the only local DC they can access.

To make things more complex, these remote offices are the "spokes" in a hub and spoke configuration. No spoke can ever talk to another spoke (through lack of routing) and each spoke has a RODC.

Question

To make management easier, I'm considering adding these hosts to our domain, but unsure if I'll lose "local admin" capability, or what will happen when the DC is unavailable.

That being said, I see an entry to configure an AD domain. It's not clear how the DCs will be selected, or how fault tolerance works, if at all on esxi.

I'm looking for someone smarter than me to help me think through the implications of connecting esxi to AD in the following scenarios:

• ESXI is hosting a VM that is a DC and is hung (1/100 DCs failed)
• ESXI can't access the servers in the hub (99/100 DCs failed)
• Normal access, where spokes are unreachable (80/100 unreachable, might seem failed)

I think these scenarios are interesting because it's entirely possible that ESXI will get a list of every NS for ADDomain.com, which equals every domain controller hosting LDAP.*

*Footnote: I assume ESXI is using LDAP.. but I'm not sure

Bottom line

Should I connect esxi in a spoke to the domain in this configuration?

Will I lose local access if no DC is available?

Answer 1

ESXi (just like any other system) will always allow local authentication (i.e. the local root user and any local user account you created) when other authentication methods are unavailable; if you have local credentials, you'll always be able to login to an ESXi server, even if vCenter, AD, or whatever else is not available.

Documentation:

http://pubs.vmware.com/vsphere-51/index.jsp#com.vmware.vsphere.security.doc/GUID-D7AEC653-EBC8-4573-B990-D8E58742F8ED.html

Answer 2

My experience with ESXi AD integration (actually Likewise) is it can be flaky. It's probably fine for small, simple topologies, but it can fall down with more complex, distributed topologies. In every case for me, a vanilla computer can join or authenticate with AD just fine using the same connection or network segment when ESXi is exhibiting issues.

Your best bet is to enable the logging for the Likewise components, otherwise you aren't going anywhere when there is an issue. And you can't do this through the UI, get the CLI.

Enabling logging for Likewise agents on ESXi/ESX (1026554)
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1026554

Regarding the "how" is it should be doing exactly what a Windows client does, and follow the DC Locator process. I would suspect it is not, or is deviating in some way.

Domain Controller Location Process
http://technet.microsoft.com/en-us/library/cc978011.aspx

Answer 3

Notes Regarding ESX(i) AD Integration:

What i've discovered (on ESXi 5.0) is when joining the ESXi host to the domain (GUI) the process via Likewise agent (on host) enumerates the trusted domains and domain controllers at the time of the join and populates a file in /etc/likewise/krb5-affinity.conf with each child/domain and associated DC.

The process seems to only enumerate the domain at that single point in time. Examining the file showed me that the listed DC's were never automatically updated because there were many old DC IPs that were decommissioned or replaced and still in that list.