Service Account being locked out periodically

[spider328]

The service account we are using to access vCenter is being locked out periodically. Active Directory would unlock the account after 30 minutes but it would get locked out again causing our VMWare backups to fail.

I am sure the credentials are good since some backups are succeeding. 

NBU showing 4243 errors but looking at vCenter, it shows "A user attempted to log in with an unknown or invalid username". 

If you can point me in a direction that would enable me to dig further into the issue that would be great. We will be trying to create a new service account and delete/re-add the credentials and will see if those work. But if anybody has seen this issue, appreciate your feedback.

Our NBU is on 7.7.3 and we just moved to vCenter 6.0. 

Thanks much.

[VirgilDobos]

Hi mate,

Have you tried to update the VMware credentials in NBU?

http://www.veritas.com/docs/000123902

[Marianne]

This sounds like a Microsoft/AD problem to me.

[Thiago_Ribeiro]

Hi spider328,

As @Marianne said it can be a Windows/AD problem, have you opportunity to check this articles:

https://communities.vmware.com/thread/425050
https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=20017...

Thiago

[spider328]

Appreciate all your responses. 

We haven't changed the password for our service account so we can rule out password mismatched.

We noticed though that it appeared when vCenter was migrated from 5.5 to 6.0. We have 4 vCenters, 1 being used for unix VMs and the other 3 for Windows VMs. The vCenter moved for the unix VMs was ok but noticed the issue when they started migrating the vCenters for the windows VMs.

I would recomment our AD guys to use the lockout tool in one of the articles you sent and see if that would identify the culprit locking up the account.

Thanks much.

[Thiago_Ribeiro]

Hi @spider328, Do they discovered the root cause?

[spider328 · Accepted solution]

We actually changed from using the short domain name (domain/serviceAccount) and instead use the the FQDN (domain.com/serviceAccount).

After the changed, vmware backups started working consistently.

Thanks so much for the inputs.

[Thiago_Ribeiro · Accepted solution]

Hi, @spider328, I understood, in my environment I use the FQDN ( domain.com\ServiceAccount). Take a look this part from Veritas NetBackup for VMware Administrator's Guide 7.7.3. Is recommended by Veritas uses the full qualified names when for VMware.

[spider328]

Nice, thanks for the info.

The environment was running ok for several years with just using the short name till they migrated the vCenter to 6.0. 

Will keep this in mind moving forward since we are adding a couple of vCenters in our environment with different credentials.