Hello Dev,
For a distributed instance, the Wazuh indexer users are meant to be changed on the wazuh indexer, so you are on the right track. You can refer to the documentation on doing this below and attached screenshot for reference:
You can run the command below to change the password. "The password must have a length between 8 and 64 characters and contain at least one upper and lowercase letter, a number, and a symbol (.*+?-)."
Please use the -v (verbose output), which provides an additional level of detail when changing the password, and share if the issue persists.
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p password-here
Please let me know if you require additional support on this.
Ref:
https://documentation.wazuh.com/current/user-manual/user-administration/password-management.html#changing-the-passwords-in-a-distributed-environment