Recently I was upgrading a vCenter 6.0 U2 to 6.5, and after successfully upgrading the external PSC, the process failed at the vCenter. After some troubleshooting, I found out that I needed to add the user to the “Replace a Process Level Token” attribute under the Local Security Policy. You can find the Microsoft documentation here. The process is simple:

1. Login into the vCenter Windows Server with your Administrator account.
2. Open the Control Panel and click the Administrative Tools.
3. Browse to and double click the Local Security Policy and then expand the Local Policies. 
4. Click on User Rights Assignment and open the Replace a Process Level Token attribute.

5. Click the Add User or Group button to add the service account.