For those who kept close watch on 5.1 Update 1 – you are aware of the failed domain login attempts to the vsphere client or the web client which will basically lock you out of your own vmware environment. What vmware had to say about the issue,

This issue can occur if the specified vCenter Server login domain user account is associated with a large number of domain groups and multiple domains are configured as SSO identity sources. The precise number of groups at which this issue can occur varies due to the nature of Active Directory internals. However, it is more likely to occur once domain-group membership for an account exceeds 19.

So if you have an SSO configured for multiple domain identity sources or if you have vcenter domain user accounts associated with large number of groups – updating to 5.1 Update 1 will break things for you!

If you already updated to vCenter 5.1 Update 1 – then the fix is you simply update vCenter to 5.1 Update 1a. The KB article is here.

The article explaining what went wrong is here. The issue was identified to have caused because of the way Active directory domain trusts work.

vCenter 5.1 Update 1 has been replaced with vCenter 5.1 Update 1a for you to download and install.

Lets hope 1a won’t break anything else 🙂

Please do comment if you feel like!