topic Re: Any way to check ESXi root password Changed Date through PowerCLI in VMware PowerCLI Discussions

Any way to check ESXi root password Changed Date through PowerCLI

Sivaramsharmar — Tue, 30 Jul 2019 03:21:29 GMT

Hi All,

Is there Any way to check ESXi root password Changed Date through PowerCLI.

ESXi version : 6.0

vCenter : 6.0

Re: Any way to check ESXi root password Changed Date through PowerCLI

LucD — Tue, 30 Jul 2019 06:55:40 GMT

Yes, the change will create a UserPasswordChanged event.

You can get those events and the date with the following.

$esxName = 'MyEsx'

Get-VIEvent -Start (Get-Date).AddMinutes(-15) -MaxSamples ([int]::MaxValue) |

where { $_ -is [VMware.Vim.UserPasswordChanged] -and $_.UserName -eq 'root' -and $_.Host.Name -eq $esxName } |

Select CreatedTime, FullFormattedMessage

You can run this against a connection to a vCenter or a connection against an ESXi node.

On an ESXi node events are kept for about 1 hour, on a vCenter events are kept for the valu

Re: Any way to check ESXi root password Changed Date through PowerCLI

Sivaramsharmar — Tue, 30 Jul 2019 07:50:27 GMT

Hi Lucd,

As there is a time factor involved as per the log retention period of ESXi & vCenter as you said, I tried for alternate approach.

I have gone through couple of blogs and found below command.

Below command is working only on ESXi 6.5 and above.

[root@localhost:~] myDays=$(cat /etc/shadow | grep root | awk -F ":"'{print $3}')

[root@localhost:~] date -d "1970-01-01 +$(($myDays *24))"

We have more servers running on ESXi 6.0 environment and above command is not working.

Is there any way that we can execute above command through PowerCLI which will work both on ESXi 6.0 & 6.5.

Re: Any way to check ESXi root password Changed Date through PowerCLI

LucD — Tue, 30 Jul 2019 09:13:13 GMT

The following can do this (there seems to be an error in your code).

It assumes that you have the Posh-SSH module installed (see Use Posh-SSH instead of PuTTY)

$esxName = 'MyEsx'

$cred = Get-Credential -Message "Credentials for $esxName"

$esx = Get-VMHost -Name $esxName

$cmdSub = @'

days=$(awk -F":" '$1 == "root" {print $3}' /etc/shadow)

seconds_since_epoch=$((days*60*60*24))

date --date=@$((seconds_since_epoch))

$session = New-SSHSession -ComputerName $esx.Name -Credential $cred -AcceptKey

$result = Invoke-SSHCommand -SSHSession $session -Command $cmdSub

Remove-SSHSession -SSHSession $session | Out-Null

$result.Output

Re: Any way to check ESXi root password Changed Date through PowerCLI

LucD — Tue, 30 Jul 2019 09:15:36 GMT

It looks as if the root password age is returned as Sat Jul 29 00:00:00 UTC 2006 when you still are using the original password defined during the installation of ESXi.

At least that is what I seem to see in ESXi 6.7

Re: Any way to check ESXi root password Changed Date through PowerCLI

RJ4719 — Tue, 10 Oct 2023 19:26:40 GMT

While I haven't had prior experience with the posh-ssh module, I find it quite intriguing, and I appreciate you bringing it to my attention.

@LucD , I'm curious about the feasibility of modifying the code snippet below to enable the collection of information for each host within a vCenter. Specifically, I'm interested in querying each host to retrieve details about local users, including password age, complexity settings, and historical data. This capability would be immensely valuable, particularly for those of us who need to navigate security audits such as PCI compliance and similar requirements. Thanks so much for all you do in this portal, truly a value add for the admins.

Additionally it would be a tremendous help to have a one stop shop script to first enable ssh on each host withing a vcenter just before attempting this audit as well.