{"id":556,"date":"2026-09-10T01:21:13","date_gmt":"2026-09-09T23:21:13","guid":{"rendered":"https:\/\/nutanix.ma\/?p=556"},"modified":"2026-09-10T01:40:45","modified_gmt":"2026-09-09T23:40:45","slug":"change-xclarity-controller-password-lenovo-thinkagile-hx3321","status":"publish","type":"post","link":"https:\/\/nutanix.ma\/index.php\/2026\/09\/10\/change-xclarity-controller-password-lenovo-thinkagile-hx3321\/","title":{"rendered":"How to Change the XClarity Controller Password on the Nutanix Lenovo ThinkAgile HX3321"},"content":{"rendered":"\n

Sooner or later on a Lenovo ThinkAgile HX cluster you’ll need to get into the XClarity Controller and find that nobody knows the password. The person who racked the nodes has left, the credentials never made it into the password manager, or a security review has just told you the default USERID<\/code> account needs rotating. It’s an awkward position, because XCC is exactly what you reach for when a node is unresponsive \u2014 and you can’t get into it.<\/p>\n\n

The good news is that you don’t need physical access, a reset jumper, or a support case. As long as the host is up and you can SSH to it, you can manage XCC accounts from the operating system with ipmitool<\/code>, over the in-band KCS interface. This walks through setting a new password for an XCC user on an HX3321 and confirming it works.<\/p>\n\n

A quick word on the hardware<\/h2>\n

The ThinkAgile HX3321 is a 1U, two-socket Certified Node \u2014 Lenovo hardware validated for Nutanix, with the software licensed separately rather than bundled as an appliance. It takes two Intel Xeon Scalable processors, has 24 DIMM slots, and carries 10 or 12 SFF hot-swap bays plus a pair of M.2 SSDs in RAID-1 for the hypervisor boot device. Clusters start at three nodes.<\/p>\n\n

Management is the XClarity Controller \u2014 Lenovo’s BMC, equivalent to iDRAC or iLO if that’s your background. On these nodes it typically ships with the XCC Enterprise<\/strong> upgrade, which is what gives you the remote console and remote media you actually want during a failure. It speaks IPMI 2.0, Redfish and SNMP alongside the web interface, and that IPMI support is what makes this procedure possible.<\/p>\n\n

\"Lenovo
The XCC login page on an HX3321 \u2014 the destination for this exercise.<\/figcaption><\/figure>\n\n

Before you start<\/h2>\n

Two things worth being clear about.<\/p>\n\n

You need root on the host.<\/strong> This works because ipmitool<\/code> talks to the BMC in-band, through the host’s KCS interface, and that channel trusts local root. That is precisely why it works without knowing the current XCC password \u2014 and also why physical and OS-level access control on your nodes matters more than people generally assume. Anyone with root on the host effectively owns the BMC.<\/p>\n\n

Do this one node at a time, and treat it as a change.<\/strong> Nothing here restarts the host or touches the CVM, so there’s no impact on running workloads \u2014 you’re only reconfiguring the management processor. But XCC accounts are how you get in when things go wrong, so record what you set, in the password manager, before you move to the next node.<\/p>\n\n

On an AHV cluster you’ll run these commands from the AHV host as root<\/code>. If ipmitool<\/code> isn’t on your path, it lives under \/usr\/bin<\/code> on the hypervisor.<\/p>\n\n

Step 1 \u2014 List the existing XCC accounts<\/h2>\n

Start by seeing what accounts exist and which are actually enabled. Channel 1 is the standard in-band channel:<\/p>\n\n

# ipmitool user list 1<\/code><\/pre>\n\n
\"Output
Thirteen slots, but only two accounts in use \u2014 both ADMINISTRATOR.<\/figcaption><\/figure>\n\n
Read this carefully before changing anything. XCC exposes thirteen user slots; on this node only two are in use. USERID<\/code> at ID 2 is the Lenovo default, and there’s a second administrator account at ID 3. The rest are empty, with NO ACCESS<\/code> as their privilege limit.<\/p>\n\n
The column that matters most is Channel Priv Limit<\/strong>. An account showing ADMINISTRATOR<\/code> has full control of the BMC; one showing NO ACCESS<\/code> is effectively disabled regardless of whether a password is set. Note the ID of the account you intend to change \u2014 you’ll pass that number to every subsequent command, and passing the wrong one silently changes the wrong account.<\/p>\n\n
This listing is also a useful audit in its own right. If you find enabled administrator accounts you can’t identify, that’s worth chasing down before you do anything else.<\/p>\n\n
Step 2 \u2014 Set the new password and enable the account<\/h2>\n
With the ID confirmed, set the password. Quote it, so the shell doesn’t interpret any special characters:<\/p>\n\n
# ipmitool user set password 3 '<new-password>'\n# ipmitool user enable 3<\/code><\/pre>\n\n
\"Terminal
Set User Password command successful \u2014 followed by enabling the account.<\/figcaption><\/figure>\n\n
You’re looking for Set User Password command successful (user 3)<\/code>. The user enable<\/code> that follows is not redundant: an account can hold a valid password and still be disabled, in which case the login will fail and you’ll waste time assuming you typed the password wrong. Running it costs nothing and removes that possibility.<\/p>\n\n
Two practical notes. XCC enforces its own password complexity policy, so a password that’s too short or too simple will be rejected \u2014 the command tells you rather than failing quietly. And because the password appears in the command, it lands in your shell history; clear it afterwards, or prefix the command with a space if your shell is configured to skip those lines.<\/p>\n\n
Step 3 \u2014 Verify from the web interface<\/h2>\n
Don’t declare this done from the command line. Open the XCC web interface for the node and log in with the account you just changed:<\/p>\n\n
\"XClarity
Logged in \u2014 health summary green and the Enterprise licence visible under System Information.<\/figcaption><\/figure>\n\n
A successful login gets you the health summary \u2014 CPU, memory, local storage, PCI, power supplies and system board, with installed counts against each \u2014 plus system information on the right, including the BMC licence level, firmware versions and network details & remote console.<\/p>\n","protected":false},"excerpt":{"rendered":"
Sooner or later on a Lenovo ThinkAgile HX cluster you’ll need to get into the XClarity Controller and find that nobody knows the password. The person who racked the nodes has left, the credentials never made it into the password manager, or a security review has just told you the default USERID account needs rotating. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-556","post","type-post","status-publish","format-standard","hentry","category-nutanix"],"_links":{"self":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/comments?post=556"}],"version-history":[{"count":3,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/556\/revisions"}],"predecessor-version":[{"id":560,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/556\/revisions\/560"}],"wp:attachment":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/media?parent=556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/categories?post=556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/tags?post=556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}