If you are in the unfortunate position in which you or someone else has forgotten the vCenter SSO v5.1 admin@System-Domain password, then you may have a problem. Particularly if there are no other users delegated as SSO administrators.

However the aim of this blog post is to help you in resetting the admin@System-Domain password in SSO 5.1 only (it is much easier in 5.5)!.


First and foremost it's worth pointing out this is completed unsupported by VMware. VMware's advise and supported method is to reinstall SSO.

However you do have 2 other possible options I have presented below.


The first options is to simply check the password for the SSO DB in clear text which may be the same as the SSO admin user password.

The second is to update the SSO SQL database admin users password hash, to essentially change the password hash to a password has we know and will change later.



Option A - If your lucky you might be able to find the password this way..


1. Check this file to see if the password used for the SSO SQL database user was the same as the password used for "admin@System-Domain"
C:\Program Files\VMware\Infrastructure\SSOServer\webapps\lookupservice\WEB-INF\classes\config.properties
Note: You will need to change the drive letter to where you install vCenter SSO to if different to C:


2. The password used for the SQL Server database is on this line "db.pass="

## Jdbc Url
## DB Username
## DB password
## DB type
## DB host



Option B - This should work if you do not know the SSO master password for "admin@System-Domain" and wish to reset it..


1. Open SQL Server Management Studio and connect to SQL server hosting SSO (RSA) database


2. Backup the SSO RSA database so you can restore it if there is a problem


3. Run the following SQL script on the SSO RSA database to set the "admin" users password hash to "VMware1234!"
Note: You can change the password later, for now we will set it to the above password to save re-installing SSO.


[PASSWORD] = '{SSHA256}KGOnPYya2qwhF9w4xK157EZZ/RqIxParohltZWU7h2T/VGjNRA=='
LOGINUID = 'admin'


3. If you try to login to vSphere Web Client at this point you may get the following message about your password has expired.


"Associated users password is expired"




4.Open an elevated command prompt and run the command:
SET JAVA_HOME=C:\Program Files\VMware\Infrastructure\jre
Note: Do not put quotes round the path and change the directory to the path you installed vCenter to

5. Navigate to the ssolscli directory (change to the directory you installed vCenter SSO to)
cd "C:\Program Files\VMware\Infrastructure\SSOServer\ssolscli"

6. Run the SSOPASS command to remove the password expiry
ssopass -d https://vcenter1.vmadmin.co.uk:7444/lookupservice/sdk admin
Note: This has to be the FQDN the certificate was generated for, localhost will not work.


7. Type your current password, even if it is expired.

8. Type the new password, and then type it again to confirm.


9. Now you can logon to the vSphere Web Client with the following credentials:


10. Change the password for the account and keep a record of it!

11. It would also be adventageous to add a domain user or group to the SSO administrators group.




Share this blog post on social media:

Social Links


All advice, installation/configuration how to guides, troubleshooting and other information on this website are provided as-is with no warranty or guarantee. Whilst the information provided is correct to the best of my knowledge, I am not reponsible for any issues that may arise using this information, and you do so at your own risk. As always before performing anything; check, double check, test and always ensure you have a backup.

Copyright ©2008-2021 Andy Barnes - Please do not copy any content including images without prior consent!

Designed and Hosted by Andy Barnes

We use cookies

We use cookies on our website. Some of them are essential for the operation of the site, while others help us to improve this site and the user experience (tracking cookies). You can decide for yourself whether you want to allow cookies or not. Please note that if you reject them, you may not be able to use all the functionalities of the site.