For VCF 4.1 and 4.2 there is no Auto-rotate password feature for every 'X' days for service accounts. This could lead to expiry of accounts.
Service accounts on vCenter Server expires for every 90 days.
operationsmanager.log
root account remediate/rotation fails after resetting root password on ESXi.
YYYY-MM-DD HH:MM:SS INFO [vcf_om,6acb08a361a64915,4adb] [c.v.v.p.r.CancelPasswordTransactionHandler,http-nio-127.0.0.1-7300-exec-9] Cancelling password rotate for entity..{"transactionId":453,"entityName":"XXXXXXX.XXXXXXX.XXXXXXX","entityId":"1b1f75dc-XXXX-XXXX-XXXX-c6b51ac0128","oldPassword":"*****","newPassword":"*****","entityType":"ESXI","credentialType":"*****","transactionStatus":"FAILED","transactionTime":"Moth Day, Year, HH:MM:SS PM","updateStage":"TEST_BEFORE_REMEDIATE","workflowId":"f31e2775-XXXX-XXXX-XXXX-abe8a27f5090","username":"root","diagnosticMessage":"{\"errorCode\":\"PASSWORD_MANAGER_VALIDATE_ESXI_CREDENTIALS_FAILED\",\"arguments\":[\"*****\"],\"errorMessage\":\"(vim.fault.PasswordExpired) {\\n faultCause = null,\\n faultMessage = null\\n}\",\"updateStage\":\"*****\",\"referenceToken\":\"BQDJV6\"}"}
To resolve this issue:
To recover Service account expired on vCenter SSO :
Service accounts on ESXI follow same policy as 'root' account, so there is no expiry days set and hence never expires unless you manually set.
For service account of ESXi expires, when expiry days set manually: