Shore Up
A locked steel cabinet with its front padlock still shut, being opened instead through a small hidden service hatch on the side where a technician inserts a physical key
FirewallsSecurity

Recover Admin Access to a Locked-Out FortiGate

Ketan Aagja7 min read
No ratings yet

Before you run this

This procedure recovers administrative access to a FortiGate when you have lost or forgotten the admin password. It uses FortiOS's built-in maintainer account, which lets you log in over the serial console immediately after a hard power cycle and reset the administrator password. That is the only thing it changes: one admin account's password. It does not erase your configuration.

A few things to be clear about before you touch the box:

  • You need physical access. This is a console-cable procedure. There is no remote way to do it — that is the whole point of the maintainer account. You also need to be able to power-cycle the unit.
  • No OS privileges apply here in the sudo/Administrator sense — you are talking to the appliance over a serial line — but you do need to be physically at the device and able to pull its power.
  • This drops all traffic. Recovering access requires a hard reboot (a real power cycle, not execute reboot). Every session and every packet through this firewall stops while it boots. Do this in a maintenance window, and tell whoever depends on the link that it is going down.
  • The console cable IS your out-of-band path. For once you don't have to worry about locking yourself out over the network — you're already on the console. Stay on it until you've confirmed the new password works.
  • Back up as soon as you're back in. You can't back up config while you're locked out, so the first thing to do after recovery is export a config backup, before you change anything else.
  • The password change is not reversible to the old value — you don't know the old value, which is why you're here. That's fine. Just record the new one somewhere safe (a password manager).
  • This fails if admin-maintainer was disabled. Some shops turn the maintainer account off for hardening. If it's off, this won't work and your only path is a firmware reload that wipes the config — see the last section.

Assumptions for this guide: a hardware FortiGate on FortiOS 7.2 or 7.4, a laptop with a terminal emulator (PuTTY on Windows, or screen/minicom on Linux), and the vendor console cable — an RJ45-to-DB9 (or the USB console port on newer models). The maintainer procedure has been stable across recent FortiOS versions, but menu wording and defaults do move, so if anything below doesn't match your unit, check Fortinet's KB article "Technical Tip: Using the maintainer account to reset a lost admin password."

Step 1 — Connect to the console

Plug the console cable into the FortiGate's CONSOLE port and into your laptop. Open your terminal emulator against the right serial port with these settings:

Baud rate: 9600
Data bits: 8
Parity:    None
Stop bits: 1
Flow control: None

That 9600 8N1 setting is the traditional default for most FortiGate models. Some newer models default to 115200 — if you get garbage or nothing at all, try 115200 next. The correct rate for your exact model is printed in its QuickStart guide.

Confirm the console is alive: press Enter and you should see a login prompt or the current session. If you see nothing, re-seat the cable and check you picked the right COM/tty device.

Step 2 — Have the maintainer credentials ready

The maintainer login is:

  • Username: maintainer
  • Password: bcpb immediately followed by the unit's serial number, entered exactly as printed on the chassis label (it is case-sensitive — use the uppercase letters as shown).

So if the serial number on the sticker is FGT60FTK0000ABCD, the password is:

bcpbFGT60FTK0000ABCD

Find the serial number on the physical label on the device (you can't run get system status — you're locked out). Type it out and double-check it now, before you reboot, because you will be in a hurry in the next step. I usually paste-ready both strings in a notepad so I can fire them in fast.

Step 3 — Power-cycle and log in as maintainer

The maintainer account is only valid for a short window right after a hard reboot, and only after a real power cycle — not a warm execute reboot. Pull the power (or flip the switch), then power it back on, and watch the console.

The exact length of that login window has varied between FortiOS versions and models, so treat it as seconds, not minutes: as soon as the login prompt appears during boot, log in immediately. Fortinet's KB for your version states the current timing; the safe assumption is to be ready and act the instant the prompt shows.

login: maintainer
Password: bcpbFGT60FTK0000ABCD

If it rejects you: the most common causes are a soft reboot instead of a hard one, a mistyped serial (case matters), missing the timing window, or the maintainer account being disabled on this unit. Power-cycle and try again, watching the timing.

Step 4 — Reset the admin password

Once you're in as maintainer, reset the password on the account you need. For the default super-admin account named admin:

config system admin
    edit "admin"
        set password YOUR-NEW-STRONG-PASSWORD
    next
end

Replace admin with the actual account name if yours is different, and YOUR-NEW-STRONG-PASSWORD with a real, strong password you record safely. Depending on model and version you may only have a brief time to enter these commands before the maintainer session ends — if it drops, repeat Step 3 and go straight to this command.

That's the whole recovery. Your configuration — interfaces, policies, VPNs — is untouched.

Step 5 — Verify

Log in with the new credentials through a normal path to confirm it took. Over the console or SSH:

login: admin
Password: YOUR-NEW-STRONG-PASSWORD

Then confirm you have real admin access and check the unit's identity:

get system status

You should see the model, firmware version, and serial number. If you can also reach the web GUI on the management interface and log in there, you're fully back.

Now do the thing you couldn't do before: take a config backup. In the GUI it's under the admin/config menu (System settings → Configuration/Backup in current FortiOS); or from the CLI, back the config up to your management station using execute backup config — check execute backup config ? in your version for the exact transport keyword (tftp/ftp/usb) and arguments rather than guessing them.

If the maintainer account was disabled

If Step 3 keeps failing and you're certain the serial and timing are right, the maintainer account may have been turned off (config system global → set admin-maintainer disable). In that case there is no password reset — your only recovery is a firmware reload from the boot loader over TFTP, which reinstalls FortiOS and resets the unit to factory defaults, wiping the configuration. That's why the config backup habit matters. I won't walk through the TFTP boot-menu steps here because the boot-loader prompts and key sequences differ by hardware generation; follow Fortinet's KB "Uploading firmware using the FortiGate BIOS / boot loader (TFTP)" for your exact model, and restore your last known-good config afterward.

A note on hardening afterward

Some admins disable the maintainer account so nobody with physical access and a power switch can reset the box. That's a real tradeoff: it closes this recovery path too. If you disable it, you are betting entirely on your config backups and TFTP reload for any future lockout. Decide that deliberately, document it, and make sure your backups are current — don't disable maintainer and then discover months later that you also have no backup.

Written by
Ketan Aagja

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

More about the author →

Was this article helpful?

Tap a star — no sign-in needed.

Be the first to rate this article.