ESXi password expiry notification limitation in SDDC Manager

Products

• VMware Cloud Foundation

Issue/Introduction

SDDC Manager will not show a password expiry notification if password expiry is configured on the ESXi hosts. 
Password expiry is set using the ESXi advanced setting, Security.PasswordMaxDays. The default password warning threshold is 14 days. 

SDDC Manager will not show a password expiry notification if the default value(99999) for Security.PasswordMaxDays is modified.

SDDC Manager will list the ESXi password as valid until they expire.

Environment

SDDC Manager 5.2.3, 9.0.2 and earlier versions

Resolution

If Security.PasswordMaxDays is configured on the ESXi hosts, passwords will need to be manually rotated. 
If passwords are not rotated before the expiry date, the ESXi accounts will be disconnected. There will be no password expiry notification. 

To resolve and fix disconnected accounts,

• Passwords should be manually updated for expired accounts directly on the ESXi hosts
• Passwords need to be remediated in SDDC Manager. See, Remediate Passwords

After password expiry, to work around the issue:

1. Retrieve the service account credentials from SDDC manager. Reference: Retrieve the service accounts credentials from SDDC Manager
2. Modify the ESXi host advanced setting Security.PasswordHistory from 5 to 0. To configure ESXi advanced settings, navigate to Host > Configure > System > Advanced System Settings
   This step is essential because ESXi enforces password history, and without this change, we cannot update the svc account password to a previously used one.
3. Connect to ESXi host via SSH (enable SSH if disabled) and change the svc account password to the one retrieved in Step 1 by running the following command `passwd`
4. Return to SDDC Manager Password Management and perform password remediation to synchronize the updated password. See, Remediate Passwords
5. After successful password remediation, revert the Security.PasswordHistory setting back to 5 to maintain security compliance.