How to check the last password change date for the ESXi root user.

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides the command and procedure to check the last password change date of the ESXi root user. Administrators may need to retrieve this account information to verify password modification timelines.

Environment

VMware vSphere ESXi

Cause

System administrators require a verified method to audit or validate when the root account password was last updated on an ESXi host.

Resolution

The command below will identify the date of the last Root password change: 

• ChangedDay=$(cat /etc/shadow | grep '^root:' | awk -F ":" '{print $3}') && date -d "1970-01-01 +$(($ChangedDay * 24))"

 

Additional Information

Please also refer to the Broadcom Knowledge Base (KB) article Check password expiration date of ESXi root user.