Servers that were successfully joined to QAS disconnect themselves. Running vastool status on the disconnected server shows errors like the following:
VAS_ERR_KRB5: Failed to obtain credentials.
KRB5KDC_ERR_PREAUTH_FAILED (-1765328360): Preauthentication failed
There is more than one server with the same shortname trying to authenticate to AD. This can happen when an organization has a naming convention like "proxy01.boston.my.company" and "proxy01.toronto.my.company". If these machines are joined to QAS with the default settings, they will both try to authenticate as proxy01 and will either fail or overwrite each other's settings.
Either give each machine in the realm a unique hostname, or join hosts with the -n option to vastool join. The computer name specified with the -n option should be either the fully qualified DNS name or the NETBIOS name for the computer object. The fully qualified DNS name can be a CNAME.