KB: Deploying a service template using System Center 2012 Virtual Machine Manager fails with error 421

Here’s a new Knowledge Base article we published. This one talks about an issue where deploying a service template using System Center 2012 Virtual Machine Manager fails with error 421.

=====

Symptoms

When deploying a service template using System Center 2012 Virtual Machine Manager (VMM), the job fails with error 421 - "Agent Installation failed due to WS-Management Configuration." After restarting the job in VMM it completes successfully. The job fails at a step where the Virtual Machine is deployed to a VMware ESX 4.1 host and the VMM agent installation is attempted on the newly created virtual machine. The VMM agent installation fails because the WinRM listener cannot be configured by the installation wizard. The following errors are recorded in the VMM agent installation log which can be found in %programdata%\vmmlogs on the newly created virtual machine:

Action start 8:54:08: CreateWsmanListener.
MSI (s) (F8!68) [08:54:08:739]: PROPERTY CHANGE: Adding CAERROR property. Its value is '1'.
1: !VMM_Error! 2: 1
1: Error occured in enumerating existing listeners
MSI (s) (F8:04) [08:54:08:755]: Note: 1: 1720 2: CreateWsmanListener 3: -2147221503 4: 5: 6: 35 7: 8
1: Cannot determine if GPO enabled listeners are present
Info 1720.There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor. Custom action CreateWsmanListener script error -2147221503, : Line 35, Column 8,

and

Action start 8:54:08: DeleteWsmanListenerWithWsmanConfigFailure.
1: !VMM_Error! 2: 1
1: Error occured in enumerating existing listeners
MSI (s) (F8:18) [08:54:08:833]: Note: 1: 1720 2: DeleteWsmanListenerWithWsmanConfigFailure 3: -2147221503 4: 5: 6: 35 7: 8

A VMM trace from the VMM server shows the following:

62704 62212,08:54:16.323 06-05-2012,0x0DCC,0x0CFC,9,GuestAgentInstaller.cs,142,0x00000000,Guest agent on server servername.contoso.com returned exit code 2148925446 (0x80160006),{00000000-0000-0000-0000-000000000000},4,
62705 62213,08:54:16.323 06-05-2012,0x0DCC,0x0CFC,16,ApplicationSubtaskHelper.cs,427,0x00000000,Guest agent install failed for VM servername.contoso.com,{00000000-0000-0000-0000-000000000000},1,
62706 62214,08:54:16.323 06-05-2012,0x0DCC,0x0CFC,16,ApplicationSubtaskHelper.cs,427,0x00000000,Microsoft.VirtualManager.Utils.CarmineException: Agent installation failed on servername.contoso.com because of a WS-Management configuration error.

Cause

This can occur if the system time on the VMware ESX 4.1 host to which the service template is deployed is not synced with the Domain Controller. This causes the newly deployed VM to have an incorrect time which causes Kerberos authentication to fail, in turn causing the VMM agent installation wizard to fail to create the WinRM listener.

The VMM agent installation wizard starts 10-30 seconds before the system time is synced on the virtual machine and the system event log on the newly created virtual machine will show the following events:

Event ID 7024: The VMMInstallDetector service terminated with the following service-specific error: %%-2146041853

Event ID 5: The Kerberos client received a KRB_AP_ERR_TKT_NYV error from the server SERVERNAME$. This indicates that the ticket presented to that server is not yet valid (due to a discrepancy between ticket and server time. Contact your system administrator to make sure the client and server times are synchronized, and that the time for the Key Distribution Center Service (KDC) in realm CONTOSO.COM is synchronized with the KDC in the client realm.

Event ID 7024: The VMMAgentInstaller service terminated with the following service-specific error: %%-2146041850

Resolution

To resolve this issue, the system time on the VMware ESX 4.1 host needs to be synced with the Domain Controller. One option is to open the VMware vSphere client on the VMware vCenter server and change the ESX host's time under the Time Configuration tab so that it matches the time on the Domain Controller. For other options please check the following VMware Knowledge Base article:

http://kb.vmware.com/kb/1003736