Resetting admin@local Password on VMware VCF Installer Appliance

This guide walks through the process of resetting the admin@local password on the VMware VCF Installer Appliance (previously known as Cloud Builder) when both the admin and root passwords are unknown.

This procedure has been tested on VCF 9.1 / ESX 9.1.

Prerequisites

• Access to the VM Console via vCenter (no SSH required)
• The VCF Installer Appliance VM must be powered on

Step 1 – Interrupt GRUB at Boot

1. Open the VM Console in vCenter for the VCF Installer Appliance
2. Reboot the VM
3. As soon as the GNU GRUB bootloader appears, press e to enter edit mode

Step 2 – Modify Boot Parameters

In the GRUB editor, locate the line starting with linux:

linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline $user_cmdline audit=1 fips=1

linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline $user_cmdline audit=1 fips=1

Navigate to the end of this line using the arrow keys and append:

rw init=/bin/bash

rw init=/bin/bash

The line should now look like:

linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline $user_cmdline audit=1 fips=1 rw init=/bin/bash

linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline $user_cmdline audit=1 fips=1 rw init=/bin/bash

Press Ctrl+X or F10 to boot with the modified parameters.

Step 3 – Reset the Root Password

The system will boot directly into a root shell. Reset the root password:

passwd root

passwd root

Enter and confirm your new root password. Note that FIPS mode is enabled (fips=1), so the password must meet complexity requirements:

• Minimum 12 characters recommended
• Uppercase and lowercase letters
• Numbers
• Special characters

Then reboot the appliance:

exec /sbin/reboot -f

exec /sbin/reboot -f

Step 4 – Log in as Root via Console

After reboot, log into the appliance console as root using the password you just set.

Step 5 – Reset the admin@local Password

The admin@local user is not a Linux OS user — it is an application-level account managed by VMware’s commonsvcs component and stored in a PostgreSQL database. The password is set using a dedicated script.

Run the following command:

sh /opt/vmware/vcf/commonsvcs/scripts/auth/set-local-account-password.sh "YourNewPassword!"

#Note: The script hashes the password using SHA-512 and Base64 encoding before storing it. No output typically means success.

sh /opt/vmware/vcf/commonsvcs/scripts/auth/set-local-account-password.sh "YourNewPassword!"

#Note: The script hashes the password using SHA-512 and Base64 encoding before storing it. No output typically means success.

Step 6 – Verify Login

Open the VCF Installer UI in your browser and log in with:

• Username: admin@local
• Password: The password you set in Step 5

Relevant File Locations

Password Complexity Requirements (FIPS Mode)

Since VCF runs with FIPS 140-2 enabled by default, passwords must meet the following requirements:

• Minimum 8 characters (12+ recommended)
• At least one uppercase letter
• At least one lowercase letter
• At least one number
• At least one special character (e.g. !, @, #)

Notes

• This procedure applies to the VCF Installer Appliance (formerly Cloud Builder), not the SDDC Manager
• The admin user does not exist as a Linux OS user — only as an application account
• Always store passwords securely after reset (use a password manager)
• SSH may not be enabled by default on the appliance — console access is always available as a fallback

Tested On