PRIVACY & SECURITY BY DESIGN
Administrator password help
The local QA package can create the documented temporary CCSI administrator once. The credential is restricted to loopback pre-production, requires MFA, and must be changed after first sign-in. No default is permitted for Google Cloud or production.
If you can sign in
Open Change password in the Administration navigation. Confirm the current password, enter a fresh authenticator code, and create the new password. Every other Administration session will be revoked.
If you cannot sign in
On the authorized Windows host, open the extracted Administration folder and run RESET-ADMIN-PASSWORD.bat. The recovery requires the administrator email, access to the enrolled authenticator, and a new password. It cannot be performed from this browser page.
If the authenticator is lost
Run RESET-ADMIN-PASSWORD-WITHOUT-AUTHENTICATOR.bat only from the authorized Windows host. It requires the separately generated recovery key in .env.admin.local, changes the password, revokes all sessions, rotates MFA, and displays a one-time new enrollment key. It never leaves MFA disabled.
Both local recovery paths write append-only audit evidence. They do not reveal the old password or create a session.