VCF 9 can rotate all your administrative passwords automatically if you do it first and foremost within the first 90 days after the initial deployment and afterwards if you remember yourself to do it regularly or if you get remembered by VCF. The latter only works for the infrastructure components at the moment (vCenter, ESX, …