Reset ESXi host root password using Host Profile

Products

• VMware vSphere ESXi

Issue/Introduction

• Unable to log in to the ESXi host because the root password is unknown.
• Unable to log in to the ESXi host using the existing root password.
• Host Profile remediation fails with the error "A general system error occurred: Weak password: based on personal login information" or "Authentication token manipulation error,"

Environment

• VMware vSphere ESXi 8.x
• VMware vSphere ESXi 7.x
• VMware vSphere ESX 9.x

Resolution

Notes

• A vSphere Enterprise Plus License is required to use the Host Profile feature.
• The ESXi host must be actively connected to vCenter to perform these steps. If the host is standalone, reinstall the ESXi host.
• This procedure updates the password to match the value configured in the host profile. It cannot retrieve or discover an unknown password.
• No tools or methods exist to recover an original or lost ESXi root password.
• Verify that the existing host profile version matches the version of all hosts in your inventory.

Reset the ESXi host root password with Host Profiles

1. Login to the vSphere Client.

2. Go to 'Home' > 'Policies and Profiles' > 'Host Profiles'.

3. Click 'Extract profile from a host'.

4. In the 'Extract Host Profile' wizard select the affected host.

5. Name the Host Profile and click 'Next' > 'Finish'.

6. Right-click the new Host Profile and click 'Edit Host Profile'.

   

7. In the 'Edit Host Profile' wizard uncheck all boxes.

8. Use the search filter to search for 'root'. Alternatively, navigate to Security and services > Security setting > Security > User configuration > root.

9. Check the box for 'root'.

10. In the 'Password' drop-down, choose 'Fixed password configuration'. 

    1.  Set the new root password in the Fixed password configuration field.
       Note: Ensure the password defined in the Fixed password configuration field within the Host Profile meets the current complexity requirements of the target host.
       
       
       

    2. Ensure that the root option is checked before saving the changes to apply the new password configuration successfully.

11. Enter the new password and click 'Save'.

12. Right-click the new Host Profile to open the 'Actions' menu. Choose 'Attach/Detach Hosts and Clusters' and then select the host in the wizard.
    
    

13. Right-click the new Host Profile to open the 'Actions' menu. Choose 'Edit Host customization'.

    Select the host which states Customization required, check the configurations and Finish [no changes needed].

14. Click the hamburger button in the upper left of the screen and select Inventory.

15. Right-click the ESXi host in the inventory. Then select Host Profiles > Remediate.

    **Caution**
    Uncheck the "Automatically reboot hosts that require remediation" to avoid rebooting the host. A reboot is not required to implement this remediation.

    
    
    
    
16. To confirm success, right-click the host and select Host Profiles > Check Host Profile Compliance.
    
    
17. Delete the host profile after remediation is successful.