Recovering ESXi root Login

  1. Boot the server up with a linux disc, such as CentOS 7 in recovery mode
  2. Once booted, mount 250MB partition. Usually /dev/sda5. mount /dev/sda5 /mnt
  3. cd to /mnt
  4. Copy state.tgz to /tmp cp state.tgz /tmp
  5. cd to /tmp, then extract state.tgz. cd /tmp; tar -zxvf state.tgz
  6. Extract local.tgz. tar -zxvf local.tgz
  7. Open the /tmp/etc/shadow file using your favorite text editor. nano /tmp/etc/shadow
  8. Under your root (or account with root), remove the shadow password. The resulting row may look like this. root::13358:0:99999:7:::
  9. Now repack all the files back in. cd /tmp; tar -zcvf local.tgz etc; tar -zcvf state.tgz local.tgz
  10. Copy the state.tgz back into /mnt. cp /tmp/state.tgz /mnt;
  11. Now reboot the server. Once ESXi is booted back online, you will be able to log into your root with a blank password.