Schedule Password Rotation for VMware Cloud Foundation Products

With SDDC Manager, you can schedule password rotation automatically for some of the managed components. You set the password rotation interval to a period shorter than the period in your password expiration policy.

To avoid password expiry before the automated rotation triggers, ensure that the next password rotation occurs between the last modified date and the password expiration date.

If your environment has more than one VMware Cloud Foundation instance joined to a single vCenter Single Sign-On domain, do not schedule password rotation for the [email protected] account. For manual rotation in such cases, see VMware Knowledge Base artcle 85485.

You can configure a password rotation schedule for the following products:

Product	Account
vCenter Server	root
vCenter Single Sign-On	For VMware Cloud Foundation 5.1 and later: [email protected] svc-<sddc_manager_hostname>-<vcenter_server_hostname>@vsphere.local svc-<nsx_manager_hostname>-<vcenter_server_hostname>@vsphere.local [email protected]
	For VMware Cloud Foundation 5.0 and earlier: [email protected] svc-<nsx_manager_hostname>-<vcenter_server_hostname>@vsphere.local [email protected]
NSX Local Manager	admin root audit
NSX Edge Nodes	root admin audit

Note:

Auto rotate is automatically enabled for vCenter Server. It may take up to 24 hours to configure the auto-rotate policy for a newly deployed vCenter Server.

Procedure

VMware Cloud Foundation 5.2.1 or later

1. Log in to SDDC Manager at https://<sddc_manager_fqdn> with a user assigned the Admin role.
2. In the left pane, navigate to Security > Password management.
3. On the Password management page, filter the list to include the accounts for which you want to schedule the password rotation.
4. Select the check boxes for all accounts and, from the Schedule rotation drop-down menu, select your desired rotation interval.
5. In the Confirm changes dialog box, click Yes.

VMware Cloud Foundation 5.2 or earlier

1. Log in to SDDC Manager at https://<sddc_manager_fqdn> with a user assigned the Admin role.
2. In the left pane, navigate to Security > Password management.
3. On the Password management page, from the components list, select the desired component.
4. In the table, select the check boxes for all accounts and, from the Schedule rotation drop-down menu, select your desired rotation interval.
5. In the Confirm changes dialog box, click Yes.