Skip to main content

Recover Account

Part of: Tagnet Admin Console — emergency password reset when no admin can sign in

The Recover Account page in the Tagnet Admin Console lets a local server administrator reset a Tagnet user's password when no admin-role user is able to sign in. It generates a temporary password, forces the user to change it on next login, and signs out any active sessions, all in a single transaction against the live database.

When to use this​

Use Recover Account when:

  • All users with the Admin role have been locked out or forgotten their passwords and cannot sign in to reset credentials through the normal Users page flow.
  • A user account has been locked out (too many failed sign-in attempts) and you need to restore access immediately rather than wait for lockout to expire.

If any admin-role user can still sign in, reset the password through the web UI instead: go to the Users page, find the user, and use the Reset Password action there. That path does not require Admin Console access or local server access, and is preferable for routine password changes. The in-app reset emits a UserPasswordResetByAdmin security event (actor type User), distinct from the UserPasswordReset event this Admin Console flow emits, so the audit log clearly separates emergency Admin Console recoveries from routine in-app resets.

What you need​

  • The Tagnet Admin Console installed on the Windows server that hosts Tagnet.
  • Local administrator rights on that Windows server (not a Tagnet admin role, but a Windows admin account on the machine itself).
  • The user's email address or username as registered in Tagnet.

How to recover an account​

  1. Open the Tagnet Admin Console from the Start menu on the server.

  2. In the left navigation, click Recover Account.

  3. If you see the Restart as administrator button, click it. The console relaunches with UAC elevation and returns you to the Recover Account page. The page requires administrator rights to read the database connection settings.

  4. In the User field, enter the user's email address or username. The lookup is case-insensitive.

  5. Read the confirmation panel, then type RECOVER (all caps) into the confirmation field. The Recover Account button enables only when the phrase matches exactly.

  6. Click Recover Account. The page shows a progress message while it connects to the database and applies the changes.

  7. On success, the Temporary password panel appears. The password is a 16-character random string containing uppercase and lowercase letters, digits, and a symbol. Visually ambiguous characters (0, O, 1, l, I) are excluded so the password is easier to read and transcribe.

  8. Click Copy password to copy it to the clipboard, then hand it to the user securely (in person, over the phone, or through a secure messaging channel). Do not send it in plain-text email.

  9. Once you have handed off the password, close or navigate away from the page. The temporary password is shown only once and is not stored anywhere. If you close the panel without copying it, run the recovery again and a new temporary password will be generated.

Important: Tell the user they will be required to set a new password immediately on their next sign-in. They cannot skip this step.

What happens to the account​

When you click Recover Account, the following changes are made to the user's account in a single database transaction. Either all changes apply or none do.

ChangeEffect
Password replaced with a temporary passwordThe user can sign in with the temporary password you hand them
MustChangePassword flag setTagnet forces a password change on their next login; they cannot skip it
Security stamp rotatedAny browser cookies or sessions tied to the old stamp are immediately invalid
Lockout clearedFailed sign-in counter reset; lockout expiry removed
Active refresh tokens revokedAll devices or browsers where the user was previously signed in are signed out
UserPasswordReset security event writtenThe action is recorded in the Security Events log under actor type AdminTool, with your Windows username as the actor

The Tagnet service does not need to be stopped. The operation runs while the service is live and takes effect immediately.

Troubleshooting​

"Administrator rights are required"​

The page shows a Restart as administrator button instead of the recovery form. Click it, and the Admin Console will relaunch with elevated privileges via Windows UAC and return you to this page.

"User not found"​

No account matched the email or username you entered. Check for typos. The lookup matches against both the email address field and the username field, so try the other form of the identifier if the first attempt fails.

"Matched N users"​

The value you entered matched more than one account. This can happen if the same string appears as a username on one account and as part of the email on another. Provide a more specific identifier: use the full email address to guarantee a unique match.

"Could not read appsettings.Production.json"​

Tagnet may not be fully configured yet, or the configuration file is inaccessible. Verify that Tagnet is installed and has been through first-run setup (the Home page of the Admin Console shows the current server state). If the file exists but is unreadable, ensure you are running the Admin Console as an administrator.

"The Tagnet database connection string is not configured"​

The Admin Console found the configuration file but no database connection is set. Open Database Setup in the Admin Console, configure the database, and try again.

"Recovery failed: ..."​

An unexpected error occurred during the database transaction. The error message is shown directly in the result panel. Common causes: the database file is inaccessible (check permissions on the data directory), or the database is in an inconsistent state (run an Integrity Check from Database Maintenance).

Security and audit​

Every successful recovery is recorded as a UserPasswordReset event in the Security Events log. The event includes:

  • The Windows username of the person who ran the recovery (under Actor)
  • Actor type AdminTool, which distinguishes this Admin Console flow from the in-app Reset Password action on the Users page, which emits UserPasswordResetByAdmin with actor type User, and from self-service password changes, which emit UserPasswordChanged with actor type User
  • The affected user's email, username, and internal ID
  • The number of active sessions that were revoked

The temporary password itself is never written to logs, the audit event, or any persistent store.