password recovery ucm 6.1

Unanswered Question
May 29th, 2008

is there a way to do a password recovery on 6.1 for the os administration

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.8 (11 ratings)
Loading.
kadambari.beelw... Thu, 06/19/2008 - 15:01

I have a cluster which has 4 ccm 6.1.1

I want to change the OS Administrator user name from "Administrator" to "administrator"

I tried using "utils reset user_administrator_ui" command but that did not change it...Is this a bug or I am using a wrong command?

rob.huffman Thu, 06/19/2008 - 15:23

Hi Kadambari,

I believe the commands are (thanks Michael!)

From the CLI, use these commands:

utils reset_ui_administrator_password

utils reset_ui_administrator_name

Hope this helps!

Rob

kadambari.beelw... Thu, 06/19/2008 - 15:30

Hello,

I used the command "utils reset_ui_administrator_name" and then logged out of the CLI and tried to log in again. it still uses the OLD user and not the new.Is this a bug.

My callmanager version is 6.1.1-2000-3

Michael Owuor Thu, 06/19/2008 - 18:24

Hi Rob and Kadambari! Hope both of you are well. Here's some info on accounts and passwords.

* The ui_administrator_name and password is used to log into the CCMAdministrator web page. To change the CCMAdministrator name or password, use the following commands from the CLI:

utils reset_ui_administrator_password

utils reset_ui_administrator_name

* The OS administrator username and password is used to log into the CLI, and also to log into the OS administration web page.

* If you would like to change the OS administrator password, which is also the password used to log into the OS administration web page, you can use the CLI commands: 'set password admin' command. This command is documented here: http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/6_1_1/cucos/iptpappa.html#wp1051854

* If you would like to create a new OS admin account and password, use the 'set account' CLI command. For example, in your case, you could enter 'set account administrator'. The output should appear as follows:

admin:set account administrator

Privilege Levels are:

Ordinary - Level 0

Advanced - Level 1

Please enter the privilege level :1

Please enter the password :*********

re-enter to confirm :*********

Account successfully created

This command is documented here: http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/6_1_1/cucos/iptpappa.html#wp1052683

* If you would like to detele an existing OS administrator account after you have created a new OS administration account, you could, if you wish, execute the 'delete account' CLI command. For example in your case, you would enter "delete account Administrator". Log in with the new account before deleting the old one. This command is also documented here: http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/6_1_1/cucos/iptpappa.html#wp1052464

* If you have lost the OS administrator password and cannot access the system via the CLI, you can use the procedure described here to recover the OS administrator password:

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/6_1_1/cucos/iptpch2.html#wp1040303

Hope this helps.

Regards,

Michael.

rob.huffman Fri, 06/20/2008 - 06:12

Hi Michael,

Sweet answer! One of the best I've seen in a long while. +5 points for this type of excellence for sure!

Rock On!

Rob

kadambari.beelw... Fri, 06/20/2008 - 06:58

After I created "administrator" I logged out and log in with administrator.Tried to delete "Administrator" I get

******************************************8

admin:delete account Administrator

Executed command unsuccessfully

No valid command entered

admin:delete

delete dns

delete ipsec

delete process

delete smtp

*************************************8

But anyways, it fixed the issue which I was running into so 5 points for your post.

Thank you

kadambari.beelw... Fri, 06/20/2008 - 07:17

Michael,

I have 2 questions for you. What I am trying to achieve is use ONLY Administrator for CM Administrator and administrator for OS Administrator account.

1. Do you know the way to remove the "administrator" account and only keep Administrator for CM Administrator.

I have used "utils reset_ui_administrator_name" but this does not remove the old account but adds a new one.

2. There is no "delete account" to remove OS Administrator username "Administrator"

TIA

Michael Owuor Fri, 06/20/2008 - 11:06

Such good questions. Good opportunities to learn more about the IPC-Platform-CLI.

* Q.1. There should only be one CCM Admin account. When changing the name of the CCM Admin account, also known as the user interface administator name, the output of the utils reset_ui_administrator_name command looks as follows:

admin: utils reset_ui_administrator_name

New administrator user name:

Administrator user name has been successfully updated to ccmadmin

-------------------- utils reset_ui_administrator_name --------------------

Reset user interface administrator user name

admin:

After changing the name, I am not able to log into the ccmadmin page with the original name. I can log in successfully with the new name.

If you get a different result, let me know what is the specific version of CUCM you are using, and I'll see if I can replicate it in my lab.

* Q.2. Looking at the list of commands available in the CLI from the previous posts, notice that for every command, there is a corresponding privilege level. This is the privilege level at which a particular command is executed. The original admin account is 4 which is hard coded in. An account with the privilege level “n” can execute all commands at level N, N-1, N-2 … 0. Any new admin accounts can only have privileges of 0 and 1. They can therefore only see and execute commands at those levels.

Guess which two accounts have privilege level of 4? The two are 'show accounts' and 'delete accounts' :-)

So you really are stuck with your original OS admin account. You can create and delete others as needed, but the original one cannot be changed.

Hope this clears it for you.

Regards,

Michael

Michael Owuor Fri, 06/20/2008 - 11:11

I just though of what the issue is regarding your question #1, and confirmed it in my lab. The name used to log into CCM Admin is not case sensitive. That should explain why you can log in with both 'administrator' and 'Administrator'. It is still the one account.

Regards,

Michael.

Michael Owuor Sat, 06/21/2008 - 09:24

Repost to capture the key takeways of the post in this thread.

Reference the CLI documentation here:

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/6_1_1/cucos/iptpappa.html

* The ui_administrator_name and password is used to log into the CUCM administration web page. In order to change the CCMAdministrator name or password, use the following commands from the CLI:

utils reset_ui_administrator_password

utils reset_ui_administrator_name

The output of the utils reset_ui_administrator_name command appears as follows (in this case the name is being set to ccmadmin):

admin: utils reset_ui_administrator_name

New administrator user name:

Administrator user name has been successfully updated to ccmadmin

-------------------- utils reset_ui_administrator_name --------------------

Reset user interface administrator user name

admin:

Note that there can only be one CCMAdministrator account. Also note that the CCMAdministrator name is not case sensitive. So in the example above, ccmadmin and CCMAdmin are the same and either could be used to log into the CUCM administration web page.

* The OS administrator username and password is used to log into the CLI, and also to log into the OS administration web page.

* If you would like to change the OS administrator password, which is the password used to log into the CLI as well as the OS administration web page, you can use the CLI commands: 'set password admin' command.

* If you would like to create additional OS admin accounts use the 'set account' CLI command. For example, to create a new account called 'newadmin, enter 'set account newadmin'. The output should appear as follows:

admin:set account newadmin

Privilege Levels are:

Ordinary - Level 0

Advanced - Level 1

Please enter the privilege level :1

Please enter the password :*********

re-enter to confirm :*********

Account successfully created

* If you would like to delete an OS admin account that was created using the 'set account' command, use the 'delete admin' command. For example, to delete the account called 'newadmin', one would execute the command 'delete account newadmin'.

Notice that while creating the new OS admin account, one is prompted to specify a privilege level associated with the account. For every command available on the IPC Platform CLI, there is a corresponding privilege level. This is the privilege level at which each particular command is executed. An OS admin account with the privilege level “n” can execute all commands at level N, N-1, N-2 … 0. Any new admin accounts created can only have privilege levels of 0 and 1. They can therefore only see and execute commands at those levels. The original admin account has a privilege level of 4 which is hard coded and cannot be changed.

The two CLI commands that require a privilege level higher than 1 are the 'show accounts' and 'delete accounts' commands, which have a privilege level of 4. These commands can therefore only be executed by the original OS admin account that was created at install. Only the original OS admin account can create or delete additional OS admin accounts.

* If you have lost the OS administrator password and cannot access the system via the CLI, you can use the procedure described here to recover the OS administrator password: http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/6_1_1/cucos/iptpch2.html#wp1040303

Hope this helps:

Regards,

Michael.

rob.huffman Sat, 06/21/2008 - 09:45

Hi Michael,

Perfect! This will now be the "blueprint" that we all reference for these type of questions :) +5 points for your great work and kindness here.

Thanks again,

Rob

edwincharles Sun, 04/08/2012 - 22:58

Dear michael,

i am not able to login to the OS adminstration page, i am not sure of the username and password.

as mentioned in  the document for password recovery, what is the valid cd should i use?

thanks

edwin

Gajanan Pande Sun, 04/08/2012 - 23:05

Edwin,

CCO has recovery software for every CUCM version released so far. If your's is CUCM 6.1, please download the recovery software from here for the exact CUCM 6.1.xxx version you have.

Hope it helps ?

GP.

Pls rate helpful posts by clicking on stars below the post !!

Actions

This Discussion