How to reset two-factor authentication for the default admin account using ADManager Plus
Objective
Learn how to reset two-factor authentication (2FA) for the default admin account in ADManager Plus. This is useful when the admin is unable to log in due to lost access to their 2FA device, expired authentication codes, or misconfigured 2FA settings.
Prerequisites
Access to the server where ADManager Plus is installed.
Ensure ADManager Plus is up and running.
An account that has the necessary privileges to execute scripts on the server.
Steps to follow
Step 1: Reset 2FA for the default admin
Log in to the server where ADManager Plus is installed.
Navigate to the installation directory (By default, located at C:\ManageEngine\ADManager Plus on Windows).
Locate the file named ResetTFAEnrollment.bat.
Right-click ResetTFAEnrollment.bat and select Run as administrator.
This will clear the current 2FA settings. The next time the admin logs in, they’ll be prompted to re-enroll for 2FA.
Step 2: Complete 2FA reset
Log out of ADManager Plus and log back in using the default admin account.
You'll be prompted to configure 2FA as a new user.
Follow the setup instructions to complete the enrollment and verify that the login is successful.
Note:
Running this process will reset 2FA for all users in ADManager Plus, prompting them to re-enroll during their next login.
Notify all admins and technicians before resetting 2FA to avoid login issues.
Only run this script when required, as it resets 2FA for all users. Ensure it's stored securely and accessed only by authorized administrators.
Tips
Coordinate with your IT team before running the reset, as all users will be required to re-enroll their second factor during their next login.
After resetting, verify that each user successfully completes their 2FA setup to maintain secure access.
New to ADSelfService Plus?
Related Articles
How to configure two-factor authentication (2FA) for technicians in ADManager Plus?
Objective: To configure two-factor authentication (2FA) for technicians in ADManager Plus. Solution: You can configure a secured login to the ADManager Plus console by configuring two-factor authentication (2FA). If ADManager Plus technicians have ...Using a Managed Service Account (MSA or gMSA) in ADManager Plus
A Managed Service Account (MSA) or group Manage Service Account (gMSA) is a more secure and scalable service account with the characteristics of a computer object. The passwords of MSAs/gMSAs are random and are automatically updated by the Windows ...How can I set up Duo 2FA using ADManager Plus?
Objective Organizations looking to enhance login security using ADManager Plus can integrate Duo Security for two-factor authentication (2FA). This setup helps prevent unauthorized access, especially in environments with sensitive AD operations. This ...How do I reset MFA for a technician in ADManager Plus?
Objective This article explains how to reset MFA for a technician account in ManageEngine ADManager Plus. Resetting MFA is often required when a technician: Changes their mobile device. Loses access to their authenticator app. Faces issues during ...Is it possible to use a third-party email provider for two-factor authentication in ADManager Plus
Yes, third party email address can be used for two-factor authentication. While logging to ADManager Plus for the first time after enabling One time password via email option in two-factor authentication, the technician/user is prompted to enter the ...