Information2 use cookies to help you have a superior and more admissible browsing experience on our website. Privacy Policy
Loading...
By:
vCenter root password expired
So the root password expired on me, running vcenter server 7.02, I was certain we had set that not to expire but apparently not.
Can I do a Web Console of the Photon OS, reboot it, and follow the instructions for resetting root without causing any issues or downtime with our VMs?
– Question from Reddit
The VCSA root password expires silently. No warning appears in the vSphere Client, and no notification is sent by default. The lockout stems from the appliance operating system, not vSphere itself.
The right recovery path depends on what credentials you still have access to. Work through the options below from least disruptive to most.
Use this method when the root password has expired but you still remember it.
https://<vcenter-fqdn>:5480 as administrator@vsphere.local to reset the root password directly from the interface.Use this method when the root password is expired or forgotten, but administrator@vsphere.local still works. This is the preferred path in production environments because no reboot is needed.
administrator@vsphere.local (or another account in the SSO Administrators group).shell.set --enable true
shell
sudo -i
pam_tally2 --user=root --reset
pam_tally2 is deprecated):sudo faillock --reset --user root
/usr/sbin/faillock --user root --reset on 8.0 U2+ may return a “permission denied” error. Use sudo faillock --reset --user root instead.passwd
Use this method only when both the root password and SSO admin access are unavailable. It requires direct console access to the VCSA virtual machine and involves a reboot.
linux. Move to the end of that line and append:
rw init=/bin/bash
mount -o remount,rw /
passwd
reboot -f
umount / before reboot -f often returns a “target is busy” error in this mode. It is safe to skip it and run reboot -f directly.These two conditions are often confused, and fixing one without addressing the other will leave the root account inaccessible. Here is how they differ:
chage policy. The system prompts for an update but does not block the account outright.To check the current state of the root account, run the following from the appliance shell.
Check password aging and expiry details:
chage -l root
Check for active lockouts (use the command that matches your vCenter version):
pam_tally2 --user=root
/usr/sbin/faillock --user root
If the root account keeps locking out shortly after a reset, an external script or monitoring tool is likely retrying with stale credentials. To identify the source, check the SSH authentication logs:
cat /var/log/audit/sshinfo.log
cat /var/log/messages | grep sshd
Once root access is restored, adjusting the expiration policy prevents the same issue from recurring. You can do this through the VAMI interface or directly from the CLI.
https://<vcenter-fqdn>:5480 as root.chage -I -1 -m 0 -M 99999 -E -1 root
chage -l root
If your security policy prohibits credentials that never expire, consider setting a 365-day maximum instead of 90 days. It reduces the risk of unexpected lockouts while staying within most compliance frameworks.
Fixing an expired password is straightforward. Preventing it from happening again takes a little more planning, but the steps are simple to build into existing workflows.
The most reliable safeguard is storing VCSA root credentials in an enterprise secrets manager such as HashiCorp Vault or CyberArk. These tools track credential ages and can alert your team before a password reaches its expiration date, removing the dependency on manual tracking.
For teams without a secrets manager, a recurring calendar reminder works well as a fallback. Set it to fire around day 75 after each password reset — that leaves enough lead time to rotate before the 90-day Photon OS limit is reached.
Root password rotation should be part of your standard quarterly VM maintenance checklist. Bundling it with regular patching cycles means it gets done consistently, without requiring a separate process or reminder.
Configure an email notification in the VAMI under Administration > Password Expiration Settings. This gives you an automatic warning a set number of days before expiry — a useful backstop for the times manual processes slip.
The GRUB recovery method in Fix 3 requires a full VCSA reboot, and any misconfiguration at the boot parameter stage can leave the appliance in an unbootable state. Before touching the GRUB menu — or making any system-level change to the appliance — taking a complete backup of the VCSA is the one step that guarantees a safe fallback.
i2Backup is built for exactly this kind of scenario: protecting VMware infrastructure before high-risk operations.
For teams that need continuous protection beyond scheduled backups, i2Availability provides real-time replication and automated failover for critical systems — keeping services running even when the primary environment goes down.
An expired VCSA root password is disruptive, but it is also entirely preventable. If you still know the old credential, a quick SSH session is all it takes to restore access. When the root password is gone but SSO admin still works, the no-reboot reset path via administrator@vsphere.local is the faster and safer option for production environments. The GRUB method remains available as a last resort when all other credentials are lost.
Whichever path you took to get back in, two follow-up steps matter: adjust the password expiration policy so the 90-day default does not catch your team off guard again, and make sure a recent VCSA backup exists before the next planned maintenance window. Info2soft’s i2Backup covers that second step — agentless VMware backups with instant recovery, so your team always has a reliable fallback before any system-level change.
For broader vSphere environment health, keeping an eye on other common appliance issues — such as log disk exhaustion on vCenter — helps prevent the kind of cascading failures that turn routine maintenance into emergency recovery.
