Local users, including root, are not functioning properly. Cannot login from the console or from SSH; cannot su to root after (incomplete) join to Active Directory (AD).
Direct cause is unknown. After a series of commands Quest Authentication Services (QAS/VAS) was joined with an incomplete PAM configuration. The symlinks that linked the system library paths with libpam_vas3.so were not present, but the pam files were configured to use it.
vastool unconfigure pam
Root should be functional now - vastool configure pam should resolve all issues as it will re-configure those symlinks.