Forgot Your ESXi Root Password? Reset It Without Reinstalling (vCenter Hack) | Lazy Admin Blog
We’ve all been there. You go to log into the DCUI or SSH into a host only to find the root password doesn’t work, and nobody documented the change.
According to VMware’s official stance, the only “supported” way to recover is a complete wipe and reinstall. But if your host is still managed by vCenter and you have Enterprise Plus licensing, there is a “lazy” (and highly effective) way out using Host Profiles.
How it works
When a host is added to vCenter, a special user called vpxa is created with full root privileges. We can use this existing “backdoor” to push a new configuration to the host, effectively overwriting the lost root password.
Step-by-Step Recovery
1. Extract the Profile
Right-click the “locked” host in the vSphere Web Client. Navigate to All vCenter Actions > Host Profiles > Extract Host Profile. Follow the wizard to create a template of that specific host’s configuration.
2. Edit the Security Settings
Go to Home > Host Profiles (under Management). Right-click your new profile and select Edit.
- Expand Security and Services.
- Expand Security Settings.
- Click on Security Configuration.
- In the dropdown, select: “Configure a fixed administrator password”.
- Enter and confirm your new root password.
3. Attach and Remediate
- Go back to Hosts and Clusters, right-click the host, and select Host Profiles > Attach Host Profile. Select the one you just edited.
- Maintenance Mode: You must put the host into Maintenance Mode.
- Remediate: Right-click the host again, select Host Profiles > Remediate. If you skip Maintenance Mode, vSphere will block the operation.
4. Finish
Once the remediation task completes, the host will reboot. Your new root password is now active!
Important Limitations
- Licensing: This requires Enterprise Plus. Standard or Essentials kits do not include Host Profiles.
- Connectivity: The host must be currently “Connected” in vCenter. If the management agent has crashed or the host is “Not Responding,” this method will not work.
The “Lazy Admin” Verdict
Reinstalling an ESXi host means reconfiguring networking, storage, and scratch partitions. Using a Host Profile takes about 10 minutes and keeps your uptime (and sanity) intact.