How to Reset the vCenter Root Password (VCSA 7.x, 8.x and 9.x): Step-by-Step Guide
Locked out of your vCenter Server Appliance because the root password expired, was forgotten or the account got locked? You do not have to rebuild the appliance.
The root account on a VCSA controls the appliance itself: its network settings, services, updates, backups and the Appliance Management Interface (VAMI). Losing it is stressful, but there are three supported ways to recover, and the best one does not even need a reboot. This guide walks through each method step by step, explains when to use which, and shows what to do afterwards so you are not locked out again in 90 days.
⚡ Quick Summary
- Best method (no reboot): SSH to the appliance with the SSO administrator, enable the Bash shell, then run
sudo passwd root. This works on VCSA 6.7 U1 and later, including 7.x, 8.x and 9.x. - If you still know the root password: change it in VAMI (port 5480). VAMI needs the current root password, so it cannot recover a lost one.
- Last resort (reboot required): edit the GRUB boot line, add
rw init=/bin/bash, reset the password, thenreboot -f. - Unlocking: a locked root account is cleared with
pam_tally2on 8.0 U1 and earlier, orfaillockon 8.0 U2 and later. - Prevent a repeat: the default root password lifetime is 90 days, so set a documented expiry policy and rotate on purpose.
Which method should you use?
Start with the situation you are actually in. The right method depends on whether you still know the root password and whether you can sign in as the SSO administrator.
| Your situation | Best method | Reboot? |
|---|---|---|
| You know the root password and want to change it | Method 2, VAMI (or passwd in the shell) | No |
| Root password forgotten, expired or account locked, and you can sign in with the SSO administrator | Method 1, SSO shell | No |
| Root account locked only (password is right) | Method 1, unlock step | No |
| You cannot sign in as the SSO administrator either, or SSH access is not available | Method 3, GRUB | Yes |
Before you start: checklist
- Know your version. Check it in the VAMI summary page or the vSphere Client. The unlock command differs between 8.0 U1 and earlier versus 8.0 U2 and later.
- Get console access. If vCenter is managed by itself and you cannot sign in, connect directly to the ESXi host that runs the VCSA and open the VM console from the ESXi Host Client.
- Plan a maintenance window. Method 3 reboots the appliance, so vCenter will be unavailable during that time.
- Confirm who has the SSO administrator credentials (for example
administrator@vsphere.local). Method 1 depends on them. - Prepare a strong new password and store it in your password vault before you change anything. The appliance enforces a complexity policy, typically a minimum length with upper case, lower case, numbers and special characters.
- Follow your change process. Resetting a privileged password should be logged and approved in most organisations.
RECOMMENDED
Method 1: Reset the root password with the SSO administrator (no reboot)
Since VCSA 6.7 U1, an SSO user in the SystemConfiguration.BashShellAdministrators group can log in to the Bash shell and use sudo without a password. The default administrator account is a member. Broadcom describes this as reducing the gap between the root and SSO administrator users, which is also why you must protect those credentials carefully (see the security section).
- Connect with SSH using the SSO administrator, for example
administrator@vsphere.local(or your own SSO domain). If SSH is disabled, sign in to VAMI with the SSO administrator and enable SSH login and Bash shell under the Access settings. - Enable the Bash shell. By default you land in the restricted appliance shell, so enable the shell first, then open it.
- Unlock the root account if it is locked. Use the command that matches your version.
- Set the new root password with
sudo passwd rootand enter it twice. - Test the new password by logging in to VAMI as root.
Commands
# 1) Connect (replace with your FQDN and SSO domain)
ssh administrator@vsphere.local@<vcenter-fqdn>
# 2) At the Command> prompt, enable and open the Bash shell
shell.set --enabled true
shell
# 3) Only if the account is locked. Choose ONE:
# vCenter 8.0 U1 and earlier
sudo pam_tally2 --user=root --reset
# vCenter 8.0 U2 and later
sudo /usr/sbin/faillock --user root --reset
# 4) Set the new root password (you are asked twice)
sudo passwd rootpam_tally2 returns “command not found”, you are on a newer release. Use the faillock command instead.KNOWN PASSWORD
Method 2: Change the root password in VAMI
If you still know the current root password, or the password is close to expiry, change it through the Appliance Management Interface. Broadcom notes that changing the root password in VAMI requires the current root password, so this method cannot recover a lost password.
- Browse to
https://<vcenter-fqdn>:5480. - Sign in with your SSO administrator credentials, or with root if you can.
- Open the account menu in the top right corner and choose the option to change the root password. This works only if the root account is not locked.
- Enter the current password, then the new password twice, and save.
If the root account is locked, VAMI cannot help. Use the unlock step in Method 1 first.
Changing it from the shell instead
If you are already in the appliance shell and the account is not locked, a user with the super administrator role can also update the password with the standard passwd command.
LAST RESORT
Method 3: Reset the root password from GRUB (reboot required)
Use this when you cannot sign in with the SSO administrator, for example when SSH and VAMI are unavailable or the SSO password is also lost. It boots the appliance into a root shell before the normal services start, so it needs console access and downtime.
- Back up and snapshot the VCSA. If the VCSA runs on the vCenter it manages, connect directly to its ESXi host with the Host Client.
- Open the VM console and reboot the appliance (restart the guest, or reset the VM if the guest is unresponsive).
- Interrupt the boot. When the Photon OS boot menu appears, press e quickly to open the GRUB edit screen.
- Edit the kernel line. Go to the end of the line that begins with
linux, add a space and typerw init=/bin/bash. - Boot with the change. Press F10 (or Ctrl+X). The appliance drops into a root shell.
- Remount the file system read-write and unlock the account if needed.
- Set the new password with
passwd. - Force a reboot and let the appliance start normally.
# In the root shell after booting with: rw init=/bin/bash
mount -o remount,rw /
# Unlock root if it is locked (choose the command that exists on your version)
pam_tally2 --user=root --reset
/usr/sbin/faillock --user root --reset
# Set the new password (twice)
passwd
# Reboot
reboot -finit=/bin/bash instead of a normal init system, use reboot -f as in Broadcom’s instructions to restart cleanly into normal mode. Then wait for all vCenter services to come up before testing.After the reset: verify and harden
- Verify access. Log in to VAMI at
https://<vcenter-fqdn>:5480as root, and test SSH if you use it. - Check that vCenter services are healthy in VAMI and that the vSphere Client loads.
- Review password expiry. Check the current settings, then decide on a policy.
- Undo temporary changes. If you enabled SSH or the Bash shell just for this task and your policy requires them off, disable them again.
- Store and document. Save the new password in your vault, record the change, and notify the team.
- Delete the snapshot after you are satisfied that the appliance is stable.
Check and set the root password expiry
The default VCSA root password expires after 90 days. Broadcom documents changing the password and expiry settings from VAMI, and the command line works too.
# Show current password ageing details for root
chage -l root
# Dell/VMware guidance for a non-expiring root password (use only if your policy allows)
chage -I -1 -m 0 -M 99999 -E -1 rootTroubleshooting
| Problem | Likely cause and fix |
|---|---|
pam_tally2: command not found | Newer appliance releases use faillock. Run /usr/sbin/faillock --user root --reset. |
| Cannot enable SSH or the Bash shell | Sign in to VAMI with the SSO administrator and enable SSH login and Bash shell under Access. |
SSO user cannot run shell | The user must belong to SystemConfiguration.BashShellAdministrators. Use the default administrator or add the account to that group. |
| GRUB menu disappears too quickly | Restart the VM and press e as soon as the Photon OS menu shows. A web console with a slow connection can make this tricky, so try the ESXi Host Client console. |
| New password rejected | It fails the complexity policy. Use a longer password with a mix of upper case, lower case, numbers and special characters. |
| Password changed but root still cannot log in, or the account keeps locking | Run the unlock command again, then see Broadcom KB 343642 about shell login issues after a password reset. |
| Root password expires again immediately | See KB 343642. It describes cases where missing parameters in appliance files cause immediate expiry. Review expiry settings with chage -l root. |
| You also lost the SSO administrator password | That is a different account and a different procedure. This guide covers the appliance root account only. Use Method 3 to regain root, then follow Broadcom’s SSO administrator reset documentation. |
Security best practices
Because a member of the Bash shell administrators group can run commands as root, treat the SSO administrator and that group with the same care as the root account itself.
- Limit group membership of SystemConfiguration.BashShellAdministrators to the few people who need it.
- Disable SSH and the Bash shell when you are not using them, if your policy allows.
- Protect VM consoles. GRUB recovery works for anyone who can open the VCSA console, so restrict vSphere and ESXi permissions accordingly.
- Use a password vault and unique credentials for the root account, with access logging.
- Monitor for logins and password changes on the appliance, and alert on unexpected activity.
- Keep the appliance patched. Update vCenter through the normal update process and keep a recent backup, tested for restore.
- Configure expiry notifications so password expiry never again surprises you at the worst moment.
Command cheat sheet
| Task | Command |
|---|---|
| Enable Bash shell (appliance shell) | shell.set --enabled true |
| Open Bash shell | shell |
| Unlock root (8.0 U1 and earlier) | sudo pam_tally2 --user=root --reset |
| Unlock root (8.0 U2 and later) | sudo /usr/sbin/faillock --user root --reset |
| Set root password | sudo passwd root |
| GRUB kernel line addition | rw init=/bin/bash |
| Remount root read-write (GRUB shell) | mount -o remount,rw / |
| Restart from the GRUB shell | reboot -f |
| Show root password ageing | chage -l root |
| VAMI address | https://<vcenter-fqdn>:5480 |
If you manage VMware infrastructure, more vSphere, VCF and Windows Server guides are on VMoreCloud.
Frequently asked questions
How do I reset the vCenter root password without rebooting?
SSH to the appliance as the SSO administrator, run shell.set --enabled true and shell, unlock the root account if needed, then run sudo passwd root. This works on VCSA 6.7 U1 and later.
How often does the vCenter root password expire?
Broadcom documents a default expiry of 90 days for the VCSA root password. You can review and change the policy in VAMI or with the chage command.
Can I reset the root password in VAMI if I forgot it?
No. Changing the root password in VAMI requires the current root password. Use the SSO administrator shell method or the GRUB method instead.
What is the difference between pam_tally2 and faillock?
Both clear failed-login lockouts on the root account. Broadcom lists pam_tally2 for vCenter 8.0 U1 and earlier and faillock for 8.0 U2 and later.
Is the GRUB method safe?
It is a supported recovery method when you take a backup and snapshot first, but it needs a reboot and gives full root access to anyone with console access. Prefer the SSO shell method whenever it is available.
Does this also reset the SSO administrator password?
No. The root account and the SSO administrator account are separate. This guide resets only the appliance root password.
Sources and further reading
- Broadcom KB 321369: Reset root password without rebooting, vCenter Server Appliance
- Broadcom KB 322247: Change or reset the root account password in vCenter Appliance (GRUB method)
- Broadcom KB 369931: Reset vCenter root account password from VAMI
- Broadcom KB 343642: Unable to log in to the VCSA shell using root after a password reset
- Dell VxRail KB: Reset the root password in vCenter Server Appliance without reboot
This guide is based on Broadcom and Dell support documentation available on October 26, 2026. Resetting privileged credentials can affect production systems, so take a backup or snapshot, follow your change-management process and verify each step against the official article for your vCenter version. Use these procedures only on appliances you are authorised to manage.
