How to Reset the Directory Services Restore Mode Administrator password

The DSRM administrator account is the only local user account on a domain controller (DC). This account is not accessible when the DC is booted into normal mode. As its name implies, the account can only be used to boot the DC into Directory Services Restore Mode. The password for the DSRM administrator account is set during the DC promotion process. Since the account is rarely used, its password can be forgotten. The following steps show how to reset its password.
   

1. Type ntdsutil.exe at an elevated command prompt to open the NTDSUtil command interface.
2. Type set dsrm password.
3. Type reset password on server dc1 (replacing dc1 with the name of the DC).
4. Type the new password.
5. Retype the new password.
6. Type quit to exit the Reset DSRM Administrator Password interface.
7. Type quit to exit NTDSUtil.

A video of this procedure is found at:

As demonstrated in the video, it is also possible to synchronize the DSRM password with the password of an existing domain account. In step 3 of the above procedure, type sync from domain account username (replacing username with the username of a domain account). Skip steps 4 and 5, which are unnecessary.

This performs a one-time synchronization. If the password of the specified domain account is later changed, the DSRM administrator password is not updated then.

Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows Small Business Server 2011 Essentials, Microsoft Windows Small Business Server 2008, Microsoft Windows Essential Business Server 2008 , Microsoft Windows 2008 Server R2, Microsoft Windows 2008 Server Service Pack 2, Microsoft Windows 2012 Server, Microsoft Windows 2012 Server R2 ... View More about warranties View Less about warranties