3

I have an AD domain joined ESXi server (v7.0 U2) that does not longer have a connection to its AD domain. When trying to remove it from the domain, it fails with:

Failed to leave the domain domain.tld: The user or group named 'DOMAIN\mygroup' does not exist.

The group DOMAIN\mygroup is a group from AD that I used to grant permissions on the ESXi host. It looks like the host is not able to remove the AD group from permissions.

When I try to remove the group manually through vSphere web client, I get a vim.fault.UserNotFound error.

When I try to remove the group through ESXi CLI, with:

 esxcli system permission unset --group --id=DOMAIN\\mygroup

I get the error The user or group named 'DOMAIN\mygroup' does not exist.

How can I remove such orphaned domain groups from ESXi permissions?

Improve this question

1 Answer 1

Reset to default
5

You can delete those groups with the following workaround:

  1. Login to your ESXi via SSH.

  2. Create a local group with exactly the same name as the orphaned group (case sensitive):

    /usr/lib/vmware/busybox/bin/busybox addgroup DOMAIN\\mygroup

  3. Then you are able to delete the group from permissions.

  4. Remove the local group afterwards:

    /usr/lib/vmware/busybox/bin/busybox delgroup DOMAIN\\mygroup
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .