Retrieve VMware Virtual Machine Password from OVF properties

When you deploy a Virtual Machine from OVF/OVA you can sometimes preconfigure passwords using OVF properties. All configuration parameters set during the deployment can be viewed later in the Web Client within VM > Configure > Settings > vApp Options but when you want to retrieve the password, the actual value is hidden:
You can't access the password from the Client, MOB, or using the API. This article explains how you can retrieve vApp option passwords from the vCenter Database.

First of all, all parameters set during the deployment are not part of the Virtual Machines configuration file (.vmx) located on the datastore. Only the vCenter itself stores the configuration in its database. That means, if you re-register the VM or migrate it to another vCenter, the VM will still work but vApp options are no longer available.

1. Connect to the vCenter Server Appliance with SSH
2. Identify vmid used in the database. In that example, I'm trying to retrieve the password from an NSX-T manager named nsxt-mgt1.virten.lab.

   # psql -U postgres -d VCDB -c "SELECT vmid,name FROM vc.vpxv_vms where name = 'nsxt-mgt1.virten.lab';"
    vmid |      name
   ------+---------------------
    1016 | nsxt-mgt1.virten.lab
   (1 row)
   
   

3. The configuration given during deployment is stored as XML in the vapp_config field in the vpx_vm table. Use the following query to get the required field. Replace id with the vmid identified above.SELECT vapp_config FROM vc.vpx_vm WHERE id = '1016';

   To get a readable output, pipe the output through xmllint.

   # psql -U postgres -d VCDB -c "SELECT vapp_config FROM vc.vpx_vm WHERE id = '1016';" -A --tuples-only -P "footer=off"  |xmllint --format -

4. Scroll up until you find the appropriate property: