Resetting forgotten or locked vCenter Server SSO administrator password

Products

• VMware vCenter Server

Issue/Introduction

• This article outlines how to reset a forgotten or locked vCenter Server (VCSA) SSO password ([email protected])
• Login to vSphere Client fails with :
  "User account is locked. Please contact your administrator." 

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x

Cause

The [email protected] account is locked after three failed login attempts. 

Resolution

Follow the procedure below to unlock the account or reset the password.

Process to Unlock SSO Password

To unlock the account using another user account with SSO administrator privileges:

1. Login to the vSphere client.
2. Navigate to Administration > Single Sign-On > Users and Groups.
3. Click the Users tab.
4. Select the affected user account, click More, and click Unlock.

If no other SSO administrator accounts are available or the password is forgotten, reset the password via the CLI.

Process to reset the password

1. Log in to VCSA using SSH as the root user.
2. Run the command to enable access to the Bash shell:
   shell.set --enabled true
    
3. Type shell and press Enter.
4. Launch the tool by running the command : /usr/lib/vmware-vmdir/bin/vdcadmintool

   The following menu will be displayed

 

5. Select option 3 (Reset account password).
6. When prompted for the Account UPN, enter:
   User@vSphere_Domain_Name.local
(Example - [email protected])
   
   Note: If your vSphere Domain name is customized, provide the customized domain name.
    
7. Copy the generated temporary password.
8. Log in to the vSphere Client using the temporary password and change it to the custom password using the steps from the following document: Change Your vCenter Single Sign-On Password

Additional Information

In an Enhanced Linked Mode setup, the SSO Admin ([email protected]) password needs to be changed on a single vCenter Server. The new password will automatically replicate to all other linked vCenter Servers.