require password to upgrade Call Manager

Unanswered Question
Aug 26th, 2008

I have taken over an existing call manager publisher and subscriber ( version 4.1) and require to perform a call manager upgrade on these servers.

I believe it requires the following password in order to do a call manager upgrade. however the only password I have is Adminstrator password.

• SQL Server SA Password

• LDAP(DC) Directory Manager Password

• Private Password Phrase

• administrator password

I have done a bit of research and the CCMPWDChanger Tool should allow me to change the DC manager password provided I have the administrator password

but how can I change the sa password and Private Password Phrase if I dont know the existing one?


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Jaime Valencia Tue, 08/26/2008 - 18:34

you need to use the adminutility tool,

start -> run -> adminutility

there's a TACCC for sa pwd but i don't have it right now since i'm home. i'll post it tomorrow if you remind me of it =)



if this helps, please rate

rachelau_2005 Tue, 08/26/2008 - 18:41

Thank you :)

When I use the Admin Utility, do I require to know the existing password phrase? or can just use this tool to reset to new one?

I just research a bit and find this document:

on step 8, it require to enter the password phrase. is this the existing password phrase? or I can enter anything here to reset the password phrase?

thank you.

Jaime Valencia Tue, 08/26/2008 - 20:40

no, it's used to reset it. you don't need to know old pwd



if this helps, please rate

rachelau_2005 Tue, 08/26/2008 - 20:43

Thank you. looking forward to hear from you tomorrow regarding changing the sa password on both pub and sub.

kind regards

Rachel :)

rachelau_2005 Wed, 08/27/2008 - 15:31


Thank you very much for the info.

I just want to confirm, if I am using the Admin Utility to change the private password, according to the document:

"The Admin Utility is used in order to change the services password and synchronize for SQLSvc, CCMServiceRW, CCMService, CCMCDR, and CCMUser in the Cisco CallManager cluster. Run this from C:\Program Files\Cisco\Bin\Adminutility.exe. The Admin Utility changes the cluster private password, which in turn generates new encrypted passwords for the SQLSvc, CCMServiceRW, CCMService, CCMCDR, and CCMUser accounts. Keep this in mind when running this utility."

Then do I still need to change the SQLSvc? or resetting the private password will generates new password for SQLSVC already and no need to manually change it myself?

also, if changing the password using CCMPWDChanger Tool for Directory Manager and using the Admin Utility to reset the private password and resetting the SQLsa password, do I have to do both on the pub and sub? or just the pub?

Thank you.

Kind regards


Jaime Valencia Wed, 08/27/2008 - 08:15

Once the DCD admin password is reset, the corresponding encrypted password need to be generated and the registry and ini file(s) need to be updated.

The tool "C:\dcdsrvr\bin\PasswordUtils" can be used to generate the encrypted password.

The following registry values, under HKLM\SOFTWARE\CiscoSystems,Inc.\DirectoryConfiguration, should be updated.


Also, the value of passwd in C:\dcdsrvr\DirectoryConfiguration.ini need to be updated.

For CM 4.0 and later, the password need to be updated in

C:\dcdsrvr\Config\UMDirectoryConfiguration.ini also.

For this, run the command "UMEncryptText" from command prompt.

It will generate a file "out.txt" at the folder from which the command was run.

Open the "out.txt" and copy the contents after "Text=". This is the encrypted password.

Now, open the file, C:\dcdsrvr\Config\UMDirectoryConfiguration.ini, using Notepad (do not use any other text editor).

Update the CiscoldapPWd and UserLdapPwd values and save the file.

Finally, restart the IIS Admin service so that the password changes are reflected when you access the CCM Admin\CCM user pages.

OR even easier, open a TAC and send them the pwd value, we have tool to decrypt it. i don't have it in this laptop but on my old PC and i don't have access now.



if this helps, please rate

jbarcena Wed, 08/27/2008 - 09:22

Send me the pwd and I will decrypt it for you, I do have the tool in my lap.

Aditionally, here you have many other pwd recovery steps:

To change the password phrase


You can use Adminutility tool to reset the Private password phrase, this tool only runs on

the Publisher and needs to be done after hours since it stops services; here is the path

and the steps to run it.


Log into the utility as Administrator and select the very top checkbox to select all

accounts. Then go to Options and Set new password

It will ask you for the password phrase, and the tool will run, everything keeps working

fine after the tool finishes.

To Change CCM Administrator:


>From the Cisco CallManager,

1. Go to Start > Run; type CCMPWDChanger and press enter.

2. Enter DC Manager Password

3. Select CCMAdministrator for Userid and password.

To Change CCM Services Password:


Please follow the following steps to reset the passwords on all servers in the cluster:

Step 1: Log on as the local Administrator on the Publisher.

Step 2: Using Explore, browse to C:\Program Files\Cisco\Bin and launch AdminUtility.exe.

Step 3: Within the User Password field, input the local Administrator password and click


Step 4: Select the check-box for at the top of the tree which should correlate to the

DNSname of the Publisher.

Step 5: Select Options from the menu, and Set New Password.

Step 6: Input your 1 - 15 character alphanumeric password phrase that will be used to

generate the complex passwords for each local account and service. Re-enter the string

within the next field for verification and click OK.

Step 7: Highlight all systems within the cluster and click Update Server Password. You

will receive a warning message informing you that this will take down all systems with the

cluster and could take a significant amount of time. Click OK.

Step 8: When completed, for each system you will see that the Update was successful. Click

EXIT once all systems within the cluster have successfully updated.

Step 9: Close the AdminUtility window.

To Change Windows Administrator Password:


Please make sure that the Local Administrator password is SAME on all servers in the


To change the password, perform the following steps:

1. Right click My Computer.

2. Select Manage.

3. Go to Local Users and Groups.

4. Go to Users.

5. Right click Administrator.

6. Select Set Password.

7. Type in the password and confirm.

rachelau_2005 Wed, 08/27/2008 - 15:39


I thought CCMPWDChanger is used to reset the Directory Manager password? cause the only password I have is the administrator password and ccmadministrator password. I need to reset the directory manager password as well.. can I use the tool CCMPWDChanger to reset it?


Kind regards


Jaime Valencia Wed, 08/27/2008 - 18:06

yes, but you require the OLD pwd to authenticate to the tool.

if you know it, then go ahead and use the ccmpwdchanger to change it



if this helps, please rate

rachelau_2005 Thu, 08/28/2008 - 22:48


I have go through the steps to reset the DC password.

then after that I use the CCMPWDChanger tool, when enter the password, it keeps saying "invalid credentials" ... instead of password mismatch when entering a wrong password...

any idea?



rachelau_2005 Sun, 09/14/2008 - 14:57

Yes, I need to run a script which i got from another person who has contacted Cisco TAC. I can send the script to you through email. whats your email address:

If the the DC Directory Manager current password is unknown, it is possible to use the attached file to change the password to 'ciscocisco'. The file can be edited to change it to anything else.

The following steps have to be done:

1. Copy the attached file to C:\dcdsrvr\run\dcx500\config directory (edit if desired with any other pwd name)

2. Run the following command from a DOS window: “cdsadmin chgpwd”

If succesful you will get an output which look like this:

Performing DSA-Administration (chgpwd)...

DSA-Administration succeeded - See C:\dcdsrvr\run\dcx500\config\chgpwd.txo

I have some difficult to attach the script here, i can send it to you through email. may i know whats your email?

rachelau_2005 Thu, 08/28/2008 - 23:02

Would you be able to send me the script that can resets the DC Directory password to default?



Jaime Valencia Fri, 08/29/2008 - 03:01

not sure which script you mean, the one that was mentioned was to find out the old pwd. then you could use the ccmpwdchanger to change it. and sorry, it's a TAC tool.



if this helps, please rate


This Discussion