Unable to remediate NSX audit account password from SDDC Manager

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• Password remediation for the NSX audit account fails in SDDC Manager with the following error:
  
  The credentials were incorrect or the account specified has been locked.
  
  
• Checking account lock status with /usr/sbin/faillock --user audit shows the account is not locked.
• Checking password expiration status with chage -l audit displays:
  
  Last password change: password must be changed
Password expires    : password must be changed
Password inactive   : password must be changed

Environment

VMware Cloud Foundation 5.x

Cause

This issue is caused by a synchronization conflict within the NSX Manager cluster. When a password is changed on a single node while management API services are active, the existing stale credentials stored on peer nodes may overwrite the local change during the next synchronization cycle (which typically occurs every few minutes).

Resolution

Perform a manual password reset via CLI on the NSX Manager node with service isolation and cluster synchronization triggers:

1. Log in to the target NSX Manager appliance as root via SSH.
2. Stop the Management Plane API service to prevent peer-node overwrites.
   
   /etc/init.d/nsx-mp-api-server stop


3. Reset the local user password (replace <username> with the affected user, e.g., audit)
   
   passwd <username>


4. Create the cluster synchronization trigger flag:
   
   touch /var/vmware/nsx/reset_cluster_credentials


5. Restart the Management Plane API service to trigger synchronization across the cluster:
   
   /etc/init.d/nsx-mp-api-server start

Additional Information

For details regarding NSX local user password resets, refer to KB NSX Local User (Root/Admin/Audit etc.) Password Reverts After Reset.