VCF 9 ESXi host root password recovery cheat sheet
Recover a managed ESXi host root account through vCenter and PowerCLI, and reconcile VCF credential management.
VCF 9 with ESXi 9 managed by a connected vCenter; this procedure changes the selected host root password.
Updated · VMware VCF · 6 min read
| Command | What it does |
|---|---|
Connect-VIServer -Server vcsa.example.com | Connect to the correct vCenter |
$hostObject = Get-VMHost -Name esx01.example.com | Select and verify the target host |
$credential = Get-Credential -UserName root -Message "Enter the new ESXi root password" | Collect the new password interactively |
$esxcli = Get-EsxCli -VMHost $hostObject -V2 | Obtain the host ESXCLI interface |
$args = $esxcli.system.account.set.CreateArgs(); $args.id = $credential.UserName; $args.password = $credential.GetNetworkCredential().Password; $args.passwordconfirmation = $credential.GetNetworkCredential().Password | Prepare the account change arguments |
$esxcli.system.account.set.Invoke($args) | Apply the approved root password change |
Walkthrough
Use an authorized vCenter administrative account and approved maintenance process. Confirm the exact host, VCF password-management policy and recovery access. The host must be connected and responding; vpxuser shell access must not be disabled. Do not record passwords in tickets or transcripts.
Step 1: Connect to the correct vCenter
Connect-VIServer -Server vcsa.example.com
Authenticate interactively with an authorized administrative account and verify the vCenter identity. The target host must be managed by this vCenter and connected; do not use this method for a disconnected standalone host.
Step 2: Select and verify the target host
$hostObject = Get-VMHost -Name esx01.example.com
Replace the example with the exact inventory name. Check the returned host and connection state before proceeding. If multiple vCenter connections exist, scope the command to the intended server to avoid selecting a different host.
Step 3: Collect the new password interactively
$credential = Get-Credential -UserName root -Message "Enter the new ESXi root password"
Enter the new root password in the secure credential prompt, following host password policy. Avoid embedding it in scripts, shell history, command lines or support tickets. The host validates its password requirements.
Step 4: Obtain the host ESXCLI interface
$esxcli = Get-EsxCli -VMHost $hostObject -V2
This obtains the versioned interface for the selected host. Confirm the target again; the next commands prepare and execute a real password change on that host.
Step 5: Prepare the account change arguments
$args = $esxcli.system.account.set.CreateArgs(); $args.id = $credential.UserName; $args.password = $credential.GetNetworkCredential().Password; $args.passwordconfirmation = $credential.GetNetworkCredential().Password
This holds the password in the current PowerShell process memory. Do not print or export the argument object. Use a private session and clear credential variables after the approved operation.
Step 6: Apply the approved root password change
$esxcli.system.account.set.Invoke($args)
This changes the root password on the selected ESXi host. Broadcom documents a true result on success. Verify access through an approved path and reconcile SDDC Manager and configuration-profile credentials using the supported workflow.
WORKED INCIDENT
Practical case: A managed host root password no longer works
Fictional teaching scenario; observations are examples, not captured production output.
Situation
A connected VCF-managed ESXi host rejects the recorded root password, while vCenter administrative access remains available.
Investigation sequence
1. Connect to the correct vCenter
Connect-VIServer -Server vcsa.example.comConfirm the vCenter endpoint and sign in with an authorized administrator.
2. Select and verify the target host
$hostObject = Get-VMHost -Name esx01.example.comCheck the inventory name and ensure that the host is connected and responding.
3. Collect the new password interactively
$credential = Get-Credential -UserName root -Message "Enter the new ESXi root password"Collect the replacement password in a secure prompt without saving it in a script.
4. Obtain the host ESXCLI interface
$esxcli = Get-EsxCli -VMHost $hostObject -V2Create the ESXCLI interface for the verified host; prepare and invoke the account change only after authorization.
Example findings
Example: vCenter is reachable and the target host is connected, so the documented PowerCLI recovery path is available.
Interpret the findings
A connected management path makes the documented host account update possible; it does not reset vCenter appliance root or automatically reconcile all VCF credential records.
Verify the outcome
Confirm the operation returns true, test access through the approved administrative path, and use VCF credential-management remediation and configuration-profile compliance checks as applicable.
Escalation handoff
Escalate disconnected hosts, failed privileges or profile drift to the VCF administrator and Broadcom support. Do not repeatedly try passwords or reinstall a host as a first step.
Broadcom ESXi root recovery using PowerCLI
Broadcom configuration profile password drift