VCF 9 vCenter appliance root password recovery cheat sheet
Reset a forgotten vCenter Server Appliance root password through an authorized SSO administrator and reconcile the VCF credential.
vCenter Server Appliance 9.x in VCF. This changes the vCenter appliance OS root account, not an ESXi host root or the SSO administrator password.
Updated · VMware VCF · 6 min read
| Command | What it does |
|---|---|
ssh administrator@vsphere.local@vcsa.example.com | Connect as an authorized SSO administrator |
shell.set --enable true | Enable the appliance Bash shell if needed |
shell | Enter the appliance Bash shell |
sudo /usr/sbin/faillock --user root --reset | Unlock root only if its account is locked |
sudo passwd root | Set a new vCenter appliance root password |
sudo chage -l root | Review the root password expiration details |
Walkthrough
Confirm the exact vCenter and approved maintenance process. Take a current backup and snapshot as required by Broadcom; for Enhanced Linked Mode follow its coordinated backup or powered-off snapshot guidance. The no-reboot method requires SSH access and an SSO user in SystemConfiguration.BashShellAdministrator; follow the linked Broadcom GRUB procedure if this access is unavailable.
Step 1: Connect as an authorized SSO administrator
ssh administrator@vsphere.local@vcsa.example.com
Replace the SSO domain and appliance FQDN with your own. This is an SSH login to the vCenter appliance, and the user must have the documented BashShellAdministrator membership. SSH and shell access must be permitted by your environment.
Step 2: Enable the appliance Bash shell if needed
shell.set --enable true
Run in the vCenter appliance shell with an appropriately authorized SSO user. Broadcom documents this when shell access has not already been enabled. Follow local policy for any later change to the shell setting.
Step 3: Enter the appliance Bash shell
shell
Run this in the appliance shell after enabling shell access if necessary. Confirm the prompt and appliance identity before running the following commands; these commands target the vCenter appliance itself.
Step 4: Unlock root only if its account is locked
sudo /usr/sbin/faillock --user root --reset
Use this conditional step for a root account locked after unsuccessful login attempts. Broadcom specifies faillock for current Photon-based vCenter releases. An expired or forgotten password does not necessarily require clearing lockout.
Step 5: Set a new vCenter appliance root password
sudo passwd root
This changes the root password. Enter and confirm the new password interactively and check the success message; do not place passwords in commands, recordings or tickets. Coordinate the new credential with VCF password management.
Step 6: Review the root password expiration details
sudo chage -l root
After the password change, review the account expiration and password-aging fields. This inspects the existing policy; do not disable expiration merely as a recovery shortcut. Verify a root login through an approved access path.
WORKED INCIDENT
Practical case: vCenter appliance root is locked after failed logins
Fictional teaching scenario; observations are examples, not captured production output.
Situation
A VCF-managed vCenter 9 appliance rejects root login, while an authorized SSO administrator retains SSH and shell privileges.
Investigation sequence
1. Connect as an authorized SSO administrator
ssh administrator@vsphere.local@vcsa.example.comConfirm the target vCenter and log in with the permitted SSO administrator.
2. Enable the appliance Bash shell if needed
shell.set --enable trueEnable the Bash shell if it is not already enabled, according to the access policy.
3. Enter the appliance Bash shell
shellEnter Bash and verify that the shell is running on the intended appliance.
4. Unlock root only if its account is locked
sudo /usr/sbin/faillock --user root --resetIf lockout is confirmed, reset the root failure counter before changing the password.
5. Set a new vCenter appliance root password
sudo passwd rootSet and confirm the new root password interactively, then check that the command reports success.
Example findings
Example: the authorized SSO shell is available, the root account was locked, and the password update completes successfully.
Interpret the findings
The reset restores the appliance root credential; it does not change ESXi host passwords or automatically update the stored VCF management credential. If SSO shell access is unavailable, use the separate reboot and GRUB recovery procedure in the linked Broadcom article.
Verify the outcome
Verify root login using the approved access path, review expiration, and use the supported VCF Operations password-management remediation workflow to reconcile the stored vCenter root credential. Confirm the account returns to Active; Broadcom notes status updates can take time.
Escalation handoff
Escalate unavailable SSO or console access, linked-mode backup questions, or failed credential reconciliation to the VCF administrator and Broadcom support. Preserve task IDs and sanitized logs without sharing passwords.
Broadcom vCenter root reset without reboot
Broadcom vCenter root recovery and GRUB procedure