Error: login pam_unix(login:account): expired password for user root during upgrade in VCF Operations

Products

• VMware NSX

Issue/Introduction

Upgrading the VCF Operations appliance to version 9.1 fails when the root password has expired. This expiration blocks the upgrade workflow and can lead to a secondary symptom where integrated component credentials, such as NSX Manager, disappear from the user interface.

Symptoms

The following symptoms are observed:

• The VCF Operations Admin UI shows the upgrade has failed or timed out.
• The standard VCF Operations UI fails to load, displaying the message: "VMware Cloud Foundation Operations is not available. You will be redirected when the service is available."
• NSX Manager credentials for the domain are missing or no longer visible in the VCF Operations dashboard.
• The /var/log/auth.log on the appliance contains the following entry:
  
  
  

  2026-06-16T18:10:18.488Z ########## login[2724]: pam_unix(login:account): expired password for user root (password aged)

Environment

• VMware Cloud Foundation 9.1
• VCF Operations 9.1

Cause

The root password on the VCF Operations appliance has expired based on the default password aging policy. This prevents the upgrade script from executing administrative tasks. When the appliance enters this inconsistent state, the credential collection service may fail to retrieve or display stored NSX Manager passwords.

Resolution

Follow these steps to remediate the expired password and resume the upgrade:

1. Revert to Snapshot: Revert the VCF Operations appliance to the pre-upgrade snapshot or restore from a recent backup.
2. Reset Root Password:
   • Log in to the appliance console via vSphere.
   • When prompted, change the expired root password.
   • If the current password is unknown, follow the recovery steps in KB 325005.
3. Verify Credential Visibility:
   • Once the password is reset, allow up to 24 hours for the credential collection service to synchronize.
   • Confirm that NSX Manager credentials have reappeared in the UI.
4. Retry Upgrade: Initiate the upgrade again through the Admin UI. For detailed steps, see the VCF 9.1 Upgrade Guide.

Additional Information

If no pre-upgrade snapshot is available, manual database remediation may be required to purge orphaned license records before re-running the upgrade PAK file. Refer to internal documentation for manual PostgreSQL cleanup procedures.