Documentation:MDrivenServer, Lost password or locked out

MDrivenServer, Lost password or locked out

This page was created by Lars.olofsson on 2018-07-22. Last edited by Wikiadmin on 2026-07-29.

You can recover access to a self-managed MDrivenServer by resetting the built-in Turnkey account, unlocking an account in the built-in database, or temporarily enabling registration to create a new administrator account.

This page is for administrators who manage the MDrivenServer installation themselves. If the installation is registered in the MDriven portal, the portal can reset or set passwords and unlock accounts by sending settings and restarting the server.

Choose a recovery method

Situation	Recommended action	Result
You can access the MDrivenServer files and need to recover the built-in account `a`.	Use PwdReset.txt.	Sets a new password for `a` and unlocks `a` at the next server start.
You can still sign in with an administrator account.	Change the password in the user interface.	Changes the selected user's password without database editing.
You have no usable administrator password, but can stop the server and access its database file.	Edit the built-in database.	Unlock an account, restore registration temporarily, or set a known password hash.
You run MDrivenServer and MDriven Turnkey in Docker.	Use the Docker password-reset procedure.	Makes `PwdReset.txt` available to the container and updates the Turnkey override settings.

Reset user a with PwdReset.txt

Use this method when you have file-system access to MDrivenServer. The account a is the account MDriven Turnkey uses to connect to MDrivenServer.

Stop MDrivenServer, or prepare to restart it after creating the file.
In the MDrivenServer App_Data folder, create a text file named PwdReset.txt.
Put only the new password in the file. Do not add explanatory text.
Save and close the file.
If MDriven Turnkey connects to this MDrivenServer, update the password in App_Data/MDrivenServerOverride.xml to the same new password before starting the services.
Restart MDrivenServer.
Confirm that you can sign in as a with the new password.

At startup, MDrivenServer reads a non-empty App_Data/PwdReset.txt, assigns its content as the password for a, unlocks a if it was locked, and deletes the file after reading it.

Important: update Turnkey too. If Turnkey still has the old password, it will repeatedly try to sign in as a. After five failed attempts, a becomes locked and Turnkey enters an error state. For a Turnkey installation that uses the relative MDrivenServer path __MDrivenServer, the connection settings are in App_Data/TurnkeySettings.xml, TurnkeySettings_extra.xml, or TurnkeySettings_override.xml. When MDrivenServer is not located relative to the Turnkey frontend, use App_Data/MDrivenServerOverride.xml for the server URL and password.

Using PwdReset.txt also turns on TurnOffRegistration. This prevents new users from registering while you restore administrative access.

Docker deployment

For Docker, create PwdReset.txt with the new password in the settings/mdriven-server folder. Bind-mount that file to /pwdreset/PwdReset.txt in the container, update MDrivenServerOverride.xml in settings/mdriven-turnkey, and restart the container. Follow the complete container-specific instructions in Documentation:Deploying MDriven Server and Turnkey with Docker.

Change a password when you can sign in

If you can sign in with an account that has administration access, change the password through the MDrivenServer user administration interface:

Sign in to MDrivenServer.
Open Settings/Users.
Select the user whose password you know and want to change.
Enter and save the new password.
If you changed the password for a, update the matching Turnkey connection settings before Turnkey next connects.

For notes about changing passwords and user registration, see Documentation:Change password MDriven Server.

Recover through the built-in database

Use database editing only when you cannot recover through PwdReset.txt or an existing administrator session. Take a copy of the database before making any change.

Stop the MDrivenServer web application so that the database is not in use. On Windows installations hosted in IIS, stop the web server in IIS Manager. On Azure, stop the site before downloading the file through Advanced Tools.
Copy MDrivenServer/App_Data/DatabaseCompact.sdf to a safe backup location.
Open a working copy of the file. See Documentation:MDrivenServer, opening the built-in database for the required SQL CE 4.0 driver and table naming.
Make the recovery change that matches your situation.
Save the database file.
Replace or upload DatabaseCompact.sdf to MDrivenServer/App_Data.
Restart the website or IIS, then verify that you can sign in.

The built-in database uses table names prefixed with Admin_ for MDrivenServer's own data. Modeled application tables use the A0_ prefix.

Unlock an existing account

A lockout follows multiple failed sign-in attempts and persists for 10 minutes. To unlock an account immediately, find the MDrivenServer user table, named Admin_ASP_Users in installations that use that table name, and set IsLockedOut to 0 (false) for the affected user.

Create a new account when all passwords are lost

If you have lost every administrator password, open the Admin_GlobalSettings table and set TurnOffRegistration to false. Restart the server if needed, register a new account, and then use that account to restore or recreate the old administrative accounts.

After recovery, turn registration off again unless you intentionally allow new users to register.

Restore the original password for user a

You can set the password hash for the a user to:

/E9hXB/R+3kx+HAZuYzI0DqwrKc=

This hash corresponds to the password 123456 only when you have not changed the machine key in web.config. Sign in, set a new private password immediately, and update Turnkey's stored password if it connects with a.

Understand the initial database

On startup, MDrivenServer looks for App_Data/DatabaseCompact.sdf. If the file does not exist, it copies App_Data/DatabaseCompact_TkStartDb.sdf to App_Data/DatabaseCompact.sdf and then opens the copied database. The DatabaseCompact_TkStartDb.sdf file is therefore the template database for a new installation.

The template includes user a with password 123456. In cloud scenarios, the portal replaces that password. Treat the template password as an initial recovery detail, not an operating password.

Prevent another lockout

Change the passwords for all administrative accounts and store them securely.
Keep at least two administrator accounts. Keep a for Turnkey connectivity and maintain another administrator account for recovery.
Assign roles according to what each account must do. The SuperAdmin role has unrestricted access; do not assign it where a lower level of access is sufficient.
Disable registration after you have the accounts you need. This blocks unapproved users from creating accounts.
When you reset a, change the corresponding Turnkey password configuration before restarting Turnkey.
Decide whether MDrivenServer needs unrestricted internet access. If you place it behind a firewall, allow the Turnkey frontends to reach it and retain a path for administrators to sign in.

If you use Windows Authentication rather than forms authentication, follow HowTos:MDrivenServer with Windows authentication to configure authentication and authorization correctly.

Contents