How to find out when the vCenter password was changed

Products

• VMware vCenter Server

Issue/Introduction

To find out when the vCenter password was changed, including root account and administrator account.

Environment

VMware vSphere vCenter 7.x

VMware vSphere vCenter 8.x

Resolution

To view the root password, use the command:

journalctl | grep "password changed"

to check historical modification times.

For the administrator account, password change records are found in /var/log/vmware/vmdird/vmdird.log. Search for the keyword "Password Modification"

e.g. cat vmdird.log | grep "Password Modification"