Unable to resolve "Password Expired" Alarms on NSX Manager Blocking VMware Cloud Foundation Upgrades

Products

• VMware NSX
• VCF Operations

Issue/Introduction

During a VMware Cloud Foundation (VCF) upgrade, the upgrade pre-check process fails due to critical Password Expired alarms on the NSX Manager nodes. Even if local accounts (root, admin, and audit) have been previously configured to never expire, these alarms persist in an "OPEN" state, preventing the VCF Upgrade Coordinator from proceeding with the upgrade task.

The passwords were set to never expire via Linux commands.

chage -m 0 -M -1 root
chage -m 0 -M -1 admin
chage -m 0 -M -1 audit

 

Environment

VCF 9.X

NSX 9.X

Cause

The password expiration was set at the Linux OS level using the chage command rather than through the supported NSX API or NSX CLI. NSX Manager's alarm health check for password expiration relies on the password policy value configured through its own supported interfaces. When expiration is set via chage instead, NSX does not correctly recognize the "never expire" configuration, so the Password Expired alarm continues to trigger and remains in an "OPEN" state regardless of the account's actual expiration setting on the OS.

Resolution

1. Log in to the NSX Manager CLI via SSH.
2. Run the following commands on all NSX Manager nodes to set a valid expiration policy (e.g., 9999 days)
   

   set user root password-expiration 9999
   
   set user admin password-expiration 9999
   
   set user audit password-expiration 9999

3. Wait approximately 10 minutes for the NSX Management Plane to resync and resolve the alarms.
4. Verify the alarm status using the NSX API or by checking the System > Alarms dashboard in the NSX UI.

 

Additional Information

Using Linux-native commands to bypass NSX password policies is unsupported and leads to Management Plane inconsistencies.