Forgotten Sophos Firewall Admin Password: Reset and Recover

If the password for the built-in admin account is genuinely lost, a physical Sophos Firewall does not need to be fully reset to factory settings. On the serial console, entering RESET in uppercase opens a recovery menu. Option 4 resets only the default admin password to its factory value.

⚠️ For password recovery alone, use Option 4 exclusively. Options 1 through 3 delete configurations or other data and are not alternative password-reset methods.

Version scope: This procedure was checked against SFOS 22.0 MR2 (Build 546). SFOS 22.0 no longer supports XG and SG hardware appliances. On those appliances or an older SFOS release, use the documentation for the version actually installed rather than assuming the menu sequence is identical.

Identify the Actual Login Problem First

Not every failed login requires this recovery procedure:

• The current password is known: Change it normally under Administration > Device access > Default admin password settings. 2 System Configuration > 1 Set password for user admin also requires the current password and therefore is not a recovery method for a forgotten password.
• The password works, but the MFA token is unavailable: Only MFA needs to be skipped or reset. The procedure is documented under Recover MFA for Sophos Firewall.
• WebAdmin and SSH are unreachable: The problem is usually the management IP, routing, or Device Access. Resetting the password does not change these settings. Device Access and Local Service ACL explains the access paths.
• A Named Admin or external login fails: Option 4 applies only to the built-in admin account. Use the documented recovery method for the relevant account or identity provider for Named Admins, RADIUS, or SSO; this serial reset does not recover them.
• The default admin password is unknown or is definitely rejected: For a physical appliance, follow the serial recovery method in this article.

This distinction prevents an unnecessary reset. In particular, Option 4 alone does not fix a missing login page or a lost MFA token.

Change a Known Password Normally

If WebAdmin is still accessible, the shortest path is Administration > Device access > Default admin password settings. Enter the current password, the new password and its confirmation, then save with Apply. A firewall with working Sophos Fusion (formerly Sophos Central) access can also be opened through Central for this purpose. The built-in admin account can’t be renamed or deleted; it remains a separately protected emergency account.

If sign-in with the current admin password still works, no recovery menu is required. In the CLI, open 2 System Configuration > 1 Set password for user admin, enter the new password twice, and then verify a fresh sign-in. The new password must meet the same complexity requirements described below for replacing the factory value.

On first CLI access, SFOS prompts for a change of the default password. If it is changed there, the setup wizard no longer starts in WebAdmin; this effect must be part of the initial-deployment plan. For an HA cluster, Sophos requires the normal CLI change on both firewalls individually. Then verify sign-in on both appliances and check the HA status.

Requirements for Serial Recovery

The following are required:

• a physical Sophos Firewall with an RJ45 COM or Micro-USB console port;
• a suitable console cable and a computer with a serial terminal program such as PuTTY;
• the COM port actually in use and a connection speed of 38400 baud;
• a trusted local management path for the first WebAdmin login;
• access to both appliances in HA because the serial password reset is not synchronized to the peer.

The physical console is privileged recovery access: anyone able to operate it can reset the default admin password to a known factory value. Keep the appliance and its console ports in a controlled area.

On production or HA systems, prepare the procedure and, where possible, perform it during a maintenance window. Sophos describes Option 4 as a password reset but does not state that it is interruption-free. A current backup remains sensible even though Option 4 is explicitly separate from a factory reset. A factory reset or restore is not a sensible first fallback: Options 1 through 3 delete data, while a restore specifically does not import the default admin password from the backup.

Reset the Admin Password Through the Serial Console

Open the Serial Connection

1. Connect the computer to the firewall’s RJ45 COM or Micro-USB port.
2. On Windows, open Device Manager and identify the COM port under Ports, for example COM7.
3. In PuTTY, select Connection type: Serial.
4. Under Serial line, enter the identified port. COM7 is only an example and must be replaced with the port shown locally.
5. Under Speed, enter 38400 and start the connection with Open.

On macOS or Linux, another serial terminal program can be used. The correct serial device and 38400 baud are what matter; this is not a normal SSH connection over the network. If Micro-USB and RJ45 are connected at the same time, the firewall gives Micro-USB priority for console output. If the terminal remains blank, first check the COM port, cable, 38400 baud, and this priority behavior.

Select Only Option 4

Once the serial console is open, enter the following value entirely in uppercase:

RESET

The menu that appears contains several actions with very different effects:

• Option 1 deletes custom configurations.
• Option 2 deletes custom configurations and resets updated pattern signatures.
• Option 3 additionally deletes reports, logs, and personal data and resets updated pattern signatures.
• Option 4 resets the default admin password.

For this procedure, enter Option 4 and confirm the prompt. RESET is not a Linux or Device Console command here; it opens the special serial-console menu. This is why the option number must be checked again before confirmation.

Sign In with the Factory Password and Secure the Account

After the reset, use the existing management IP and configured WebAdmin port. If the default port has not been changed, a local example looks like this:

https://192.0.2.1:4444

192.0.2.1 is a documentation address and must be replaced with the actual management IP. Then sign in with these factory credentials:

Username: admin
Password: admin

The firewall then prompts for a new password. It must contain at least ten characters, including an uppercase letter, lowercase letter, number, and special character, and it must not be a commonly used password or dictionary word. Store the new password in the designated password manager, apply it with Apply, then sign out and sign in again to verify it.

The factory password must not remain active beyond this first login. Do not expose WebAdmin over WAN for this purpose; change the password through the existing trusted management path.

Option 4 is not an MFA reset. Password and MFA recovery are separate actions. If MFA still blocks access after Option 4, use an accessible Device Console and run 2 System Configuration > 7 Reset multi-factor authentication for Admin user. If this access is also unavailable, contact Sophos Support. The complete MFA procedure is documented under Recover MFA for Sophos Firewall.

Special Considerations for HA, Virtual, and Cloud Firewalls

Bring Both HA Appliances to the Same Password State

In an HA cluster, the password reset must be performed separately on both appliances. Resetting only the Primary is not sufficient because this step is not synchronized to the Auxiliary.

1. Run Option 4 through the serial console of the current appliance.
2. Run Option 4 separately on the peer appliance.
3. Sign in to the Primary’s WebAdmin with admin / admin.
4. Set a new secure password.
5. Verify the HA state and login afterwards.

The reason for this sequence is that the newly set password is synchronized only when both appliances previously had the same password. After both nodes have individually been reset to the factory value, the Primary can synchronize the new password to the Auxiliary again.

Virtual, Software, and Cloud Firewalls

The publicly documented SFOS 22 recovery method explicitly refers to the physical RJ45 COM and Micro-USB ports. It does not establish a general, supported RESET procedure for every hypervisor or provider console used by virtual, software, or cloud firewalls.

If the firewall is already managed in Sophos Fusion, is online, and is accessible there to your administrator, WebAdmin can be opened through Central and the local admin password changed there. Otherwise, check the hypervisor or provider console, the existing recovery plan, and Sophos Support before redeploying the instance or restoring a backup.

Checks After Recovery

Signing in is only the first success. Check the following afterwards:

• Sign out and sign in again with the new password.
• Test MFA for the default admin and securely store additional one-time codes.
• Verify a second authorized administration path and any existing SSH public keys. Connect to Sophos Firewall via SSH explains key management.
• Continue to allow WebAdmin and SSH under Administration > Device access only from the intended networks.
• Update the password, responsible people, and recovery procedure in the password manager or emergency runbook.
• Review configuration changes and any Central user identities recorded in the Audit Trail; also check Central access in Sophos Fusion.
• Keep the backup file, backup password, and SSMK separate but discoverable. A backup restore does not replace the existing default admin password.

FAQ