Executing the authorized command "set user audit password" from the admin shell sets the account's last-changed date to Epoch 1970-01-01.
Article ID: 442638
Updated On:
Products
Issue/Introduction
When an administrator executes the CLI command to reset the password of a lower-privileged user (such as the audit user) on an NSX Edge, Bridge, or NSX Manager, the target user's password status immediately changes to PASSWORD_EXPIRED (e.g., displaying messages like "Current password expired 20509 day ago"). This behavior generates proactive system alarms for password expiration across the impacted appliances.
Environment
VMware NSX
Cause
This behavior is by design and aligns with global security compliance frameworks.
When a high-privileged user (admin) resets a lower-privileged user's password via the CLI, the system treats this as a temporary password assignment. To ensure privacy, strict password ownership, and prevent privilege abuse, the underlying Linux operating system resets the user's last-changed date metadata to the Unix Epoch start date (1970-01-01). This explicitly forces the target user to update and define their own unique password upon their next login session.
[NOTE] This password reset operation does not lock out the user from SSH or console access, nor does it terminate any active sessions. The audit user can still log in using the newly assigned temporary password and will be prompted natively to update it.
Resolution
This is expected system behavior. No software defect exists. To manage the account state and clear the resulting alarms, utilize one of the following standard workflows:
Option 1: Complete the Password Ownership Cycle (Recommended)
Have the target user (audit) log into the NSX-CLI or shell via SSH or Console using the temporary password set by the admin. The system will prompt them to change it. Once the user sets their own password, the account state automatically reverts to ACTIVE.
Alternatively, if the password needs to be programmatically updated without forcing an expiration state, the user must rotate their own password. This can be accomplished via:
CLI (As the user themselves): set user <username> password [<password> [old-password <old-password>]]
API Platform: Utilizing the native user self-service API: PUT /api/v1/transport-nodes/{transport-node-id}/node/users/{userid}
Option 2: Manage Alarms in the NSX UI
If the administrator intentionality reset the password and needs to clear the active alerts:
Log into the NSX Manager UI.
Navigate to the Alarms tab.
Filter the alarms using Event Type: Password Expired (apply Entity Name or Type filters if necessary).
Select the reported alarms and click Resolve.
Option 3: Deactivate Unused Accounts
If the audit user account is no longer required on the specific NSX Edge or Manager appliances, the recommended practice is to entirely deactivate the target account rather than leaving it in an expired state.
Additional Information
For further details regarding password operations, see the VMware NSX Documentation on Resetting User Passwords.
For managing expired states, see Resetting Expired Passwords.
Feedback
