One thing that would also be helpful is to bulk remove ssh access for ‘root’ for those environments that still have that enabled. I presumed it would be something along the lines of:

Set-VMhostAccount -UserAccount “root” -GrantShellAccess $False

using PowerCLI 4. I manually removed SSH access through the VIClient and I can connect with Connect-VIServer as ‘root’ and restore access by setting the Boolean to $True but not disable it by setting to $False.

Better example:
# Connect to the VI Server
Write-Host “Connecting to vCenter”
Connect-VIServer “vcenter.example.com”
$VMHosts = Get-VMHost | Sort-Object Name
Disconnect-VIServer -Confirm:$False

ForEach ($VMHost in $VMHosts)
{
$HostName = $VMHost.Name
Connect-VIServer $HostName -User “root”
Set-VMHostAccount -UserAccount “root” -password “vmware”
Disconnect-VIServer -Confirm:$False
}

Example:
# Connect to the VI Server
Write-Host “Connecting to vCenter”
Connect-VIServer “vcenter.example.com”
$VMHosts = Get-VMHost | Sort-Object Name
Disconnect-VIServer -Confirm:$False

ForEach ($VMHost in $VMHosts)
{
$HostName = $VMHost.Name
$myGroups = @()
$myGroups += “wheel”
$myGroups += “users”
Connect-VIServer $HostName -User “root”
Set-VMHostAccount -UserAccount “root” -password “vmware”
Disconnect-VIServer -Confirm:$False
}