37

I forgot my Sitecore admin password and was thinking a way to reset from database level.

Is there a SQL query to reset Sitecore admin password ?

  • Łukasz Skowroński's answer works great. Cheers mate – DeeVade Mar 4 '18 at 11:29
49

Yes there is.

Switch to your core database and execute the SQL below to reset the password to b:

UPDATE [aspnet_Membership] SET Password='qOvF8m8F2IcWMvfOBjJYHmfLABc=' 
WHERE UserId IN (SELECT UserId FROM [aspnet_Users] WHERE UserName = 'sitecore\Admin')

Alternatively navigate to /sitecore/admin/unlock_admin.aspx and click Unlock Administrator. For this to work, you must first "unlock" the functionality. Open up the .aspx file and modify the following code:

// TODO: to enable the page, set enableUnlockButton = true;
private bool enableUnlockButton = false;

enter image description here

  • 1
    So you reset the password, but that's the salted / encrypted version, right? What would this new password be? admin / b ? – Laver Oct 3 '16 at 22:08
  • 2
    Yes, it gets reset to "factory default". b. – Mark Cassidy Oct 3 '16 at 22:08
84

The accepted answer is valid for previous version of Sitecore, but it does not reset the password salt and doesn't in fact reset the password to 'b'. In order to do this, you need the following script (which also will unlock the admin user if locked):

UPDATE 
    [aspnet_Membership] 
SET 
    [Password]='qOvF8m8F2IcWMvfOBjJYHmfLABc=', 
    [PasswordSalt]='OM5gu45RQuJ76itRvkSPFw==', 
    [IsApproved] = '1', 
    [IsLockedOut] = '0'
WHERE 
    UserId IN (
        SELECT UserId FROM dbo.aspnet_Users WHERE UserName = 'sitecore\Admin'
    ) 
  • 1
    This worked on Sitecore 8 Update 1, thanks! – Ben Sewards May 24 '18 at 17:59
  • 3
    Worked on Sitecore 9.0.1 as well – OriolBG Jul 11 '18 at 14:53
  • 1
    This answer is better as opposed to the accepted answer, as it resets the salt as well. When changing salts, passwords and hashing algorithms and moving back to SHA1 (in case of experimenting), this approach does the job correctly – Bas Lijten Jul 19 '18 at 7:35
  • 6
    Worked on 9.1 too – Andi AR Jan 31 at 18:47
  • 1
    Works for Sitecore 9 – Captain Squirrel Oct 4 at 12:37
21

Unlock_Admin doesn't work when you will decide to change your password encryption from SHA1 into SHA512 (regarding to Sitecore recommendations). It does NOT reset password for Sitecore admin - it just unlock the Sitecore account - as the name of method says. Here you have got a code of this method:

public override bool UnlockUser(string username)
{
  this._api.CheckParameter(ref username, true, true, true, this._api.UserNameLength, "username");
  ID applicationId = this.GetApplicationID(this.ApplicationName, false);
  if ((object) applicationId == null || applicationId == ID.Null)
    return false;
  SqlMembershipUser userByName = this._api.GetUserByName(username, applicationId);
  if (userByName == null)
    return false;
  return userByName.Unlock();
}

To reset the password you need to change code inside unlock_admin.aspx file which you will find in path:

\sitecore\admin\unlock_admin

Just replace:

Membership.GetUser("sitecore\\admin").UnlockUser();

With:

var user = Membership.GetUser("sitecore\\admin");
user.UnlockUser();
user.ChangePassword(user.ResetPassword(), "b");

Additionally you can put this file directly in the webroot if you can not access it in default location - remember to delete it later.

  • Excellent, this worked for me as i have an instance that has been upgraded to SHA512 – JGilmartin Jan 21 '18 at 14:24
  • 1
    This works for Sitecore 9.1.1 as well. Note that you should reference the \Config\production\Sitecore.IdentityServer.Host.xml config file to ensure the correct Core DB is being referenced. And since you are resetting the password anyway, might as well use something other than 'b' and use LastPass/BitLocker/1Password to address the efficiency issue of logging in. – Sirius_B Jul 3 at 13:41
3

It's not a SQL query, but this will work even when you switch HashingAlgorithms. You can create a small console application to reset/change passwords. I based this console app on the one from Bas Lijten on Github.

public class Program
{
    public static void Main(string[] args)
    {
        var userName = args[0];
        var password = args[1];
        var user = Membership.GetUser(userName, false);
        var oldPassword = user.ResetPassword();
        user.ChangePassword(oldPassword, password);
    }
}

You can then use it in the command line like this.

ResetPassword.exe "sitecore\admin" b

I'm switching to a different Hashing algorithm, and when you change the HashAlgorithm both in Sitecore and in your console app config, it just works. Here's the app.config

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <startup> 
      <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />
  </startup>
  <connectionStrings>
    <add name="core" connectionString="connectionstringtocoredb" providerName="System.Data.SqlClient"/>
  </connectionStrings>
  <system.web>
    <membership defaultProvider="sql" hashAlgorithmType="SHA512">
      <providers>
        <clear />
        <add name="sql" type="System.Web.Security.SqlMembershipProvider" connectionStringName="core" applicationName="sitecore" minRequiredPasswordLength="1" minRequiredNonalphanumericCharacters="0" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" />
      </providers>
    </membership>
  </system.web>
</configuration>
1

To get this to work with my version of Sitecore (8.1u3) after switching hashing algorithms to SHA512, I needed to make the following small adjustment to Derek's answer.

USE [sitecorecmsSitecore_Core];

UPDATE 
    [aspnet_Membership] 
SET 
    [Password]='K8N8GUW8UiNT2mPdjvuBDH+QmvA3R61M9buVvCwFHwtDjpMzTxs34lg0uQ0azCITqh6FkUZlX4kM72lsAyuyXQ==', 
    [PasswordSalt]='p5B6HOWKt0ctMZaSNXTlfw==', 
    [IsApproved] = '1', 
    [IsLockedOut] = '0'
WHERE 
    UserId IN (
        SELECT UserId FROM dbo.aspnet_Users WHERE UserName = 'sitecore\admin'
    );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.