Yes, the change will create a UserPasswordChanged event.
You can get those events and the date with the following.
$esxName = 'MyEsx'Get-VIEvent -Start (Get-Date).AddMinutes(-15) -MaxSamples ([int]::MaxValue) |
where { $_ -is [VMware.Vim.UserPasswordChanged] -and $_.UserName -eq 'root' -and $_.Host.Name -eq $esxName } |
Select CreatedTime, FullFormattedMessage
You can run this against a connection to a vCenter or a connection against an ESXi node.
On an ESXi node events are kept for about 1 hour, on a vCenter events are kept for the valu
