Resetting SDDC Manager or VCF Installer Passwords

In VMware Cloud Foundation, managing the SDDC Manager (the central control component) is crucial for operating a Software Defined Datacenter (SDDC). If the credentials for the root or vcf user accounts expire or are forgotten, access to the entire infrastructure can be blocked. Broadcom’s support article provides a step-by-step guide to resetting both accounts without having to reinstall the system, which I would like to walk through here.

Why can passwords expire?

VMware Cloud Foundation uses two primary user accounts for administrative tasks:

root – provides full system privileges on the SDDC Manager virtual machine (VM)
vcf – a dedicated account used for many management tasks

When the password age policies kick in – typically after a configured number of days – the accounts can be locked, resulting in error messages such as “You are required to change your password immediately (password expired)” or “su: Authentication_failure”.

For recurring problems – especially when root access remains blocked even after a password change – an additional “unlock sequence” lifts the account lock and allows you to log in again.

Step-by-step guide

Locate the SDDC Manager VM Log in to the vSphere Client (vCenter). Find the VM with the “SDDC-Manager” or “VCF-Installer” role.
Restart the VM and access GRUB Select the SDDC Manager VM, click “Edit”, switch to the “VM Options” tab, expand “Boot Options” and set the delay to 10000 ms. Then open the console and click “Actions” → “Power” → “Reset”. When the Photon boot screen appears, press “e” to edit the GRUB bootloader.
Add a kernel parameter Use the arrow keys to navigate to the line starting with linux and append the following at the end:
```
rw init=/bin/bash
```
Example:
```
linux ... rw init=/bin/bash
```
Save the changes with F10 to continue booting.
Reset the accounts Depending on the VCF version, run one of the following commands:
- VCF 4.3.0.0 to 5.0.0.1
```
/usr/sbin/pam_tally2 -u root -r
/usr/sbin/pam_tally2 -u vcf -r
```
- VCF 5.1.0.0 and later
```
/usr/sbin/faillock --user root --reset
/usr/sbin/faillock --user vcf --reset
```
Repeat the process until no more errors occur (the “Failures” column shows 0).
Set temporary passwords
```
passwd vcf
passwd root
```
Follow the prompts to create new temporary passwords.
Reboot and initial connection
```
reboot -f
```
Wait a few minutes and establish an SSH connection to the SDDC Manager. Log in with the vcf account and the newly set password. Then switch to root with the following command:
```
su root
```
Enter the temporary root password.
Clear the password history
```
echo "" >/etc/security/opasswd
```
Set final passwords Use passwd vcf and passwd root again to create permanent passwords. Make a note of these changes.
Optional adjustment of password aging If you need longer password lifetimes, you can adjust them with the following commands:
```
chage -M 999 vcf
chage -M 999 root
```
Verify the configuration with:
```
chage -l root
```

Fixing a persistent root account lock

In some cases, the root account remains locked even after the accounts have been reset, because the system still stores its expiration date. To fix this:

Repeat steps 4 to 11 to boot the system into a root shell.
Temporarily reset the expiration date:
```
chage -I -1 -m 0 -M 99999 -E -1 root
```
Reset all failed attempts (again using the appropriate command for your VCF version).
Check the status with chage -l root.
Restart the system: reboot -f.

Conclusion

Credential management is particularly critical in VMware Cloud Foundation, where a single locked account can affect multiple processes. The method described above enables administrators to quickly recover passwords and restore normal operations without additional tools or downtime for the entire infrastructure.

References