Circumstances causing vpxuser password expiration or authentication failures on ESXi hosts

Products

• VMware vSphere ESXi

Issue/Introduction

In vSphere environments, the service account vpxuser is used by vCenter Server to manage and communicate with ESXi hosts.
Under certain conditions, the vpxuser password on an ESXi host expires or becomes unsynchronized, leading to authentication errors, management disconnections, or "Not Responding" host states in vCenter Server.

Environment

VMware vSphere ESXi 8.0
VMware vCenter Server 8.0

Cause

The vpxuser account password on the ESXi host expires when local host security policies or operational states prevent vCenter Server from completing its scheduled 30-day password rotation cycle prior to host-side expiration.

Resolution

Identify and address the specific operational scenario causing the password mismatch or expiration:

1. Shortened Local ESXi Host Password Expiration Policy:

   • Cause: By default, vCenter Server automatically changes and rotates the password for vpxuser on ESXi hosts every 30 days. If the ESXi host's local advanced parameter Security.PasswordMaxDays is manually modified to a value less than 30 days, the host security policy triggers password expiration before vCenter executes its scheduled rotation.

   • Fix: Reset or adjust Security.PasswordMaxDays on the ESXi host to a value greater than 30 days (or default 99999) via Advanced Host Settings.

2. Extended Maintenance Mode Duration:

   • Cause: When an ESXi host is placed in Maintenance Mode, vCenter Server intentionally delays/pauses the automatic vpxuser password rotation. If the host remains in Maintenance Mode longer than allowed by Security.PasswordMaxDays, the password expires on the ESXi host side, resulting in authentication failures upon exiting Maintenance Mode.

   • Fix: Ensure ESXi password policies accommodate long maintenance windows, or manually reconnect the host using root credentials if the session expires.

3. Prolonged Network Disconnection:

   • Cause: If an ESXi host loses management network connectivity or remains offline for more than 30 days, vCenter Server cannot reach the host to update the password at the 30-day rotation mark.

   • Fix: Restore network connectivity.
     In the vSphere Client, right-click the host, select Connection > Disconnect, then select Reconnect and provide the root account credentials to re-establish management agents and reset vpxuser.

4. Conflicting vCenter Advanced Parameter Settings:

   • Cause: Modifying the vCenter advanced setting VirtualCenter.VimPasswordExpirationInDays (which controls vCenter's password rotation interval for vpxuser) without aligning ESXi Security.PasswordMaxDays causes premature expiration (e.g., setting vCenter rotation to 60 days while ESXi expires passwords after 30 days).

   • Fix: Ensure VirtualCenter.VimPasswordExpirationInDays on vCenter Server is set to a duration shorter than Security.PasswordMaxDays on all managed ESXi hosts.

Additional Information

For detailed steps on configuring expiry settings and managing the vpxuser account, refer to KB 320773.