Password used for VM Customization is Unknown

Products

• VMware vCenter Server

Issue/Introduction

• The password configured in the New VM Customization Specification is forgotten or Unknown.
• When inspecting there configured password it is seen as a hashed version of what was entered.
  
  The password as entered during the configuration of the VM Custom Specification .
  
  
  The password after saving the configuration is now seen in the hashed form from this point on.

Environment

vCenter X

Cause

• In vCenter Server 8.0, Virtual Machine Customization Specifications (CustSpecs) utilize a multi-layered cryptographic approach to secure sensitive guest OS credentials. When a password is entered into a CustSpec via the vSphere Client or API, it undergoes Data Encipherment before being committed to the database.
• Guest OS passwords defined within CustSpecs are strictly prohibited from being stored in plaintext within vPostgres.
• The password is only decrypted as part of the guest OS customization phase of the virtual machine deployment process.
  
  
  

 

Resolution

• There is no method for decrypting the current unknown password.
• Edit the New VM Customization Specification with a new password.
  • This will only affect new deployments. Existing VMs will not be affected.
• This password is only used for the local administrator account of the deploying VM.
• Existing virtual machines will need to have their local administrator account password recovered using methods common to the OS vendor's recommendations.
• If the password is not recoverable then a redeployment of the VM will be needed.