Backup, Password Rotation, and Certificate Triage
SDDC Manager backups to an SFTP server have failed for six days with 'connection refused'. The network team changed the backup server's IP address, but DNS still resolves the old address. At the same time, the AD team changed the password for the svc-vcf service account directly in Active Directory. SDDC Manager's scheduled password rotation now fails for vCenter and NSX Manager. A vCenter certificate in the management domain expires in 10 days. An NSX upgrade is scheduled in seven days. The instance has three workload domains and no recent successful configuration backup.
1. What is the triage order for the backup, password, certificate, and upgrade issues, and why?
Read the worked answer
Order: backup connectivity, credential synchronization, certificate replacement, then upgrade.
- Fix the backup path first: correct DNS or update the SFTP target to the new IP, verify SFTP credentials, host key, and free space, then run an on-demand backup and confirm the file timestamp and size. Without a backup, an upgrade or certificate change has no recovery point.
- Synchronize the svc-vcf credential in SDDC Manager to the new AD password, unlock the account if locked, then run rotation to confirm. A stale credential will fail upgrade prechecks and can lock accounts.
- Replace the expiring vCenter certificate through SDDC Manager certificate management before the 10-day deadline. An expiry during upgrade is avoidable change-induced downtime.
- Only then proceed with the NSX upgrade. The upgrade prechecks expect healthy backups and valid credentials.
2. Why did the out-of-band AD password change break SDDC Manager password rotation, and what is the correct fix?
Read the worked answer
SDDC Manager stores the service account credential and uses the stored password to authenticate before setting a new password. Changing the password directly in AD makes the stored credential stale. Retrying rotation simply reuses the old password, fails, and may lock the account.
The fix is to update the stored credential in SDDC Manager to the current AD password, not to retry rotation blindly. After the credential is synchronized, run a rotation to prove the account works. Check each component that uses the account, such as vCenter and NSX Manager, and confirm the AD account is unlocked and compliant with password policy.
3. What backup validation would you require before the NSX upgrade?
Read the worked answer
Run a fresh on-demand SDDC Manager backup after fixing the SFTP target. Confirm the job succeeds, the file exists on the SFTP server, the timestamp is current, and the size is consistent with prior backups. Verify retention and free space, and document the restore procedure. Also confirm component-level backups for vCenter and NSX Manager, because the SDDC Manager backup is not a substitute for every workload or component recovery requirement. Do not accept a six-day-old backup as the upgrade recovery point.