False positive "NSX password expired" alert in VCF Operations 9.1.x when NSX manager passwords are set to never expire

Products

• VCF Operations
• VMware NSX

Issue/Introduction

The "NSX password expired" alert triggers consistently in VCF Operations 9.1.x for NSX vApp objects, even after all users passwords for the affected NSX managers have been reset and configured to never expire.

Specific symptoms include:

• Active alerts for Password manager / password expired / approaching expiration in 10 days / user on NSX manager objects.
  nsxmgr> get user admin password-expiration
  <date>
  Password expiration not configured for this user.
User will receive warning messages 7 days before password expires.

• VCF Operations indicates the password is expired despite the NSX API showing the account status as ACTIVE.
• The issue persists even after performing the Remediate Password workflow in SDDC Manager 9.1.x.

Environment

VCF Operations 9.1.x 

VCF NSX 9.1.x

Resolution

To resolve this alert in version 9.1.x, manually update the password change frequency to a value greater than 90 days.

1. Log into one of the NSX Manager command line as admin
2. Check the user indicated in the alarm password expiration using the following command:
   nsxmgr> get user <user> password-expiration
3. If the expiration date is less than 365 days, run the following command, which sets the expiration to 365 days:
   nsxmgr> set user admin password-expiration 365
4. Confirm expiration date has been changed by running the following command:
   nsxmgr> get user admin password-expiration
   
5. Repeat these steps for any other local user accounts identified in the alarms.
6. Once the expiration date has been set, the alarms should be resolved.

Additional Information

Remediate Passwords for VMware Cloud Foundation Components

NSX Manager passwords show as expired, even after updating them in Fleet Management (KB 441866)

Configuring Password Expiration and Rotation in VCF 9.x (KB 435599)

Resetting the Passwords of an Appliance