Short answer: Broadcom cannot recover a lost ESXi root password, only replace it. If the host is still connected to vCenter, reset root with a Host Profile, vSphere Configuration Profiles or PowerCLI (esxcli system account set). If it is joined to Active Directory, an “ESX Admins” member can reset it. A standalone host with no other admin access must be reinstalled with VMFS preserved. Editing the configuration store offline is an unsupported lab workaround.
Supported ways to reset the ESXi root password
Broadcom lists the options in KB 393496 (ESXi 7.0 and 8.0). Choose one based on what still has access to the host:
| Method | Requirement | Support status |
|---|---|---|
| Host Profile | Host connected to vCenter; vSphere Enterprise Plus license | Supported (KB 323617) |
| vSphere Configuration Profiles | Clusters managed by configuration profiles instead of Host Profiles | Supported (KB 393496) |
| PowerCLI / esxcli via vCenter | Host connected to vCenter; on 8.x shell access for vpxuser | Supported (KB 376979) |
| AD account in “ESX Admins” | Host joined to AD; access to a domain controller | Supported (KB 390021) |
| Reinstall, preserve VMFS | Standalone host with no other admin path | Supported (KB 393496) |
| Offline edit of state.tgz / configstore | Physical access, Linux VM, nested ESXi | Unsupported, lab only |
Reset root with a Host Profile (host managed by vCenter)
Here is a summary of KB 323617, which also covers ESX 9.x:
- In Policies and Profiles > Host Profiles, extract a profile from a healthy host of the same version.
- Edit the profile, clear all sections, search for root and set Fixed password configuration with the new password.
- Attach the profile to the affected host, edit the host customization, then Remediate. No reboot is required, so you can clear the automatic reboot option.
- Check compliance, then delete the temporary profile.
Reset the ESXi root password with PowerCLI
If Host Profiles are not licensed, KB 376979 runs esxcli system account set through vCenter. The host must not be Disconnected or Not Responding. On ESXi 8.x, shell access for the vpxuser account must be enabled, and the KB says the method fails if root is lost and that shell access is disabled.
Connect-VIServer vcenter.example.local
$creds = Get-Credential -UserName "root" -Message "Enter root as username and new password"
$esxiserver = Get-VMHost -Name esx01.example.local
$esxcli = Get-EsxCli -VMHost $esxiserver -V2
$userarg = $esxcli.system.account.set.CreateArgs()
$userarg.id = $creds.UserName
$userarg.password = $creds.GetNetworkCredential().Password
$userarg.passwordconfirmation = $creds.GetNetworkCredential().Password
$esxcli.system.account.set.invoke($userarg) # returns true on successReset via Active Directory (“ESX Admins”)
For an AD-joined host, KB 390021 uses the default admin group. Create an AD group named exactly ESX Admins and add a user to it. Sign in to the VMware Host Client with that account, then edit root under Manage > Security & users > Users. Caveat: from ESXi 8.0 Update 3, Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd defaults to false (KB 369707, the CVE-2024-37085 hardening). On those hosts, this only works if an AD group was already given admin rights on the host.
Standalone host: reinstall ESXi and keep VMFS
With no vCenter, AD or other admin account, the supported path in KB 393496 is a reinstall. Evacuate or power off the VMs. Reinstall the same ESXi version on the boot device and choose to preserve the VMFS datastore. Then restore the configuration if you have a backup, and re-register the VMs from the datastore. A configuration bundle only helps if you took it earlier. See how to back up and restore ESXi host configuration.
Unsupported: editing the ESXi configuration store offline
Older guides replace the password hash in /etc/shadow inside state.tgz from a Linux live CD. William Lam points out that this no longer works from ESXi 7.0 Update 1 onward, because host configuration moved into an encrypted configuration store. His workaround copies the host’s encrypted state from the boot device. It decrypts that state in a nested ESXi VM, edits the password hash in the configstore SQLite database, re-encrypts it and writes it back.
Treat this as lab only. It is not a Broadcom-documented procedure, and it is not in any Broadcom KB. It modifies the boot device directly, and a mistake can leave the host unbootable. On production hosts use one of the supported methods above, or open a support case.
Prevent the next lockout
- Store root passwords in a vault and rotate them on a schedule (VCF password management does this for managed hosts).
- Keep a second local admin, or an AD group, with the Administrator role.
- Back up host configuration after every change. Useful esxcli commands are in esxcli commands for ESXi 8.0.
Further reading
- Original post: Recovering ESXi 7.x & 8.x host after forgetting or losing root password (William Lam)
- Broadcom KB 393496: Methods to recover the ESXi host root password
- Broadcom KB 323617: Reset host root password with Host Profile
- Broadcom KB 376979: Reset root password of ESXi using PowerCLI
