Just wondering, when deploying this OVF, did you pick Thin provisioning by any chance?
I had the same issue as you describe, but as soon as I redeployed it from scratch with Thick provisioning Eager zeroed - this issue was gone.
I have the same problem with version 6.7 and 6.7u1.
Where does the virtual disk type touch the root password policy?
It would appear that the vSAN Witness Appliance is not being deployed properly.
The recommendation would be to deploy a new appliance.