6.0.3

The services associated with the solution user no longer have access to vCenter Server and cannot function
as vCenter Server services.
Change Your vCenter Single Sign-On Password
Users in the vsphere.local domain can change their vCenter Single Sign-On passwords from the
vSphere Web Client. Users in other domains change their passwords following the rules for that domain.
You can change a vCenter Single Sign-On password from the vSphere Web Client.
The vCenter Single Sign-On lockout policy determines when your password expires. By default, vCenter
Single Sign-On user passwords expire after 90 days, but administrator passwords such as the password for
[e-mail] do not expire. vCenter Single Sign-On management interfaces show a warning
when your password is about to expire.
This procedure explains how you can change a password. If your password is expired, the administrator of
the local domain (vsphere.local by default) or another member of the Administrators group for the local
domain can reset the password by using the dir-cli password reset command.
Procedure
1 Log in to the vSphere Web Client using your vCenter Single Sign-On credentials.
2 In the upper navigation pane, to the left of the Help menu, click your user name to pull down the menu.
As an alternative, you can select Administration > Single Sign-On > Users and Groups and select Edit
User from the right-buon menu.
3 Select Change Password and type your current password.
4 Type a new password and conrm it.
The password must conform to the password policy.
5 Click OK.
vCenter Single Sign-On Security Best Practices
Follow vCenter Single Sign-On security best practices to protect your vSphere environment.
The vSphere 6.0 authentication and certicate infrastructure enhances security in your vSphere
environment. To make sure that infrastructure is not compromised, follow vCenter Single Sign-On Best
Practices.
Check password
expiration
The default vCenter Single Sign-On password policy has a password lifetime
of 90 days. After 90 days, the password is expired and the ability to log is
compromised. Check the expiration and refresh passwords in a timely
fashion.
Configure NTP
Ensure that all systems use the same relative time source (including the
relevant localization oset), and that the relative time source can be
correlated to an agreed-upon time standard (such as Coordinated Universal
Time—UTC). Synchronized systems are essential for vCenter Single Sign-On
certicate validity, and for the validity of other vSphere certicates.
NTP also makes it easier to track an intruder in log les. Incorrect time
seings can make it dicult to inspect and correlate log les to detect
aacks, and can make auditing inaccurate.
Chapter 2 vSphere Authentication with vCenter Single Sign-On
VMware, Inc. 59