Hướng dẫn reset password vcenter
 

How to unlock and reset SSO password in vSphere 6.x (2146224)

Last Updated: 2/10/2020Categories: Best Practices
9Language: subscribe



Purpose
This article provides steps to unlock and reset the SSO password (administrator@vsphere.local) in vSphere 6.x

Note: You must unlock and reset the vCenter Single Sign-On (SSO) password in vSphere 6.x if you have entered an incorrect password three times and you see the error:

User account is locked. Please contact your administrator.

This article will explain how to reset SSO-password for vCenter server appliance and windows version.




Resolution
Process to Unlock SSO Password:

To unlock an account using another session or using another user account with SSO administrator privileges:

1. Click Home.
2. Click Administration.
3. Click Single Sign-On > Users and Groups.
4. Click the Users tab.
5. Right-click the affected user account and click Unlock.

Note: Unlock the account using another session that is still logged into the PSC server or using another user account with SSO administrator privileges. Reset the password using below steps, if you do not have any other SSO Admin accounts to unlock the Administrator Account (Reset process will automatically Unlock the account).

In emergency situations or if the default policies are changed, you can also reset the password to unlock the account.
Process to Reset SSO Password:

• On a Windows PSC or vCenter Server with Embedded Platform Services Controller
• On the PSC or vCenter Server with Embedded Platform Services Controller Appliance

On a Windows Platform Services Controller or vCenter Server with Embedded Platform Services Controller:

1. Log in to vCenter Server with a domain administrator account. If the Platform Services Controller is installed separate from vCenter Server, log in to the Platform Services Controller server.
2. Open an elevated command prompt ( Run command prompt as administrator )
3. Run c:\> "%VMWARE_CIS_HOME%\vmdird\vdcadmintool.exe".
   
   This console loads:
   
   ===============================
   Please select:
   0. exit
   1. Test LDAP connectivity
   2. Force start replication cycle
   3. Reset account password
   4. Set log level and mask
   5. Set vmdir state
   ===============================
4. Press 3 to enter the Reset account password option.
5. When prompted for the Account UPN, enter:
   
   User@vSphere_Domain_Name.local (Example - Administrator@vsphere.local)
   
   A new password is generated.
   
   Notes:
   • If you customized your vSphere Domain name, provide the customized domain name.
   • If the preceding steps fail with a error "VmDirForceResetPassword failed (5)", use the Built In Local Administrator Account to login to the vCenter Server (through RDP or Console) and retry the operation by executing vdcadmintool.
   • If vdcadmintool fails to execute, please verify the size of the file. It should not be '0 kb' in size. If size is 0 KB, copy the file from another vCenter with similar build. Contact VMware Support if you don't have any other environments to copy the file.
     • vdcadmintool.exe is located at C:\Program Files\VMware\vCenter Server\vmdird\
6. Use the generated password to log in to the User@vSphere_Domain_Name.local account.
7. After the password is regenerated, log in to vSphere Web Client and change the user password.

On the Platform Services Controller or vCenter Server with Embedded Platform Services Controller Appliance

1. Log in to vCenter Server Appliance using SSH as the root user.
2. Run this command to enable access the Bash shell:
   
   shell.set --enabled true
3. Type shell and press Enter.
4. Run /usr/lib/vmware-vmdir/bin/vdcadmintool.
   
   This console loads:
   
   ================================
   Please select:
   0. exit
   1. Test LDAP connectivity
   2. Force start replication cycle
   3. Reset account password
   4. Set log level and mask
   5. Set vmdir state
   ================================
5. Press 3 to enter the Reset account password option.
6. When prompted for the Account UPN, enter:
   
   User@vSphere_Domain_Name.local (Example - Administrator@vsphere.local)
   
   A new password is generated.
   
   Note: If your vSphere Domain name is customized, provide the customized domain name.
7. Use the generated password to log in to the User@vSphere_Domain_Name.local account.
8. After the password is regenerated, log in to the vSphere Web Client and change the password.

https://kb.vmware.com/s/article/2146224