vSphere Client displays Active Directory password expiration warning

Products

• VMware vCenter Server

Issue/Introduction

When logging into the vSphere Client using an Active Directory (AD) account, users receive a warning message stating: "Your Password will expire in X Days".

Environment

VMware vCenter Server 7.x, 8.x

Cause

This behavior occurs because vCenter Server acts as a passthrough for the identity provider's status.
During the LDAP/Identity handshake, the AD Domain Controller provides metadata regarding the account status. vCenter correctly reflects this metadata in the UI.

Resolution

1. Verify the Expiration Date

• To confirm what AD is reporting to external applications like vCenter, run the following command from a Windows command prompt within the domain:

net user <username> /domain

• Look for the "Password expires" line. This date should match the timeframe observed in the vCenter UI.

2. Update the AD Account

• Once the expiration date is verified via the net user command, perform one of the following:

1. 1. Reset the Password: Change the password for the service account in Active Directory.
   2. Modify Policy: Work with your Active Directory administration team to determine if the account should be exempted from the standard rotation policy or moved to a "Password Never Expires" group.

3. Synchronize Integrated Endpoints

• If the password was reset, immediately update the credentials in all integrated solutions leveraging this service account (e.g., VMware Cloud Director, Aria Automation, or backup software) to prevent service lockouts.

4. Verification

• Once the AD expiration date is extended or cleared, log out and back into the vSphere Client. The UI will no longer receive the "near-expiry" flag, and the warning will be resolved.