recovery account (recovery_admin)
Asked by Elaina_Hall:

I am trying to walk through the steps enable the **recovery_admin** account. I have tried the following, but I am still unable to authenticate with the recovery_admin account.

1. Stop the Confluence service
2. Edit **setenv.bat** with the following line:
   1. set CATALINA_OPTS=-Datlassian.recovery.password=pass %CATALINA_OPTS%
3. start confluence with **start-confluence.bat**

Confluence starts properly and the login page is accessible, unfortunately I'm still unable to log in.

I have also tried updating the security credentials for the **admin** account directly in the H2 database, this does not appear to work either. However I'm not positive that the steps I followed for this process are accurate. Specifically, the credentials for all users in the database start with **{PKCS5S2}** however the database steps say to use the string

```
'x61Ey612Kl2gpFL56FT9weDnpSo4AV8j8+qx2AuTHdRyY036xxzTTrw10Wq3+4qQyB+XURPWx1ONxp3Y3pB37A=='?
```

Any thoughts?


Answers:
author: Brant Schroeder
body: Since you are on version 6.14.1 you will need to follow these instructions to recover your password: <https://confluence.atlassian.com/conf64/restore-passwords-to-recover-admin-user-rights-936511358.html>

comments: author: Elaina_Hall
body: Are you sure those are the steps?

The instructions on this page indicate that version 6.5 (and up) should follow these instructions:

<https://confluence.atlassian.com/conf614/restore-passwords-to-recover-admin-user-rights-965546142.html>

Or am I miss understanding how confluence version number increase. 6.14 \> 6.5, correct?


author: Brant Schroeder
body: Elaina,

Sorry you are correct. For some reason I had it in my head you were using 6.1 not 6.14. Does your Confluence site use another user directory besides Confluence? (Jira, Active Directory, etc)


author: Elaina_Hall
body: Brant,

I also have JIRA installed, but I do not believe the two products are linked in any way. Is there a way to confirm this? (I believe both use their own H2 database)


author: Brant Schroeder
body: You can see if you have multiple directories in the database by running the following SQL: select \* from cwd_directory.

Thanks  
Brant


author: Elaina_Hall
body: Brant,

Confluence is currently only configured with one directory:

1. Confluence Internal Directory

Any thoughts on my next steps? Is there a way I can export the data and import it into a new database? Extract a password hash from another database? Upgrade confluence to a newer version? etc?


author: Brant Schroeder
body: Elaina,

I wonder if something was missed during the recovery steps. What type of server our you hosting on?


author: Elaina_Hall
body: Brant,

I am hosting on Window 2012R2, confluence is normally hosted as a windows service, but while attempting the recovery I have disabled the service and I'm launching confluence from the command line.


author: Elaina_Hall
body: Brant,

Just a thought, and I could be mistaken... but it looks like the hashing algorithm for passwords has changed since 6.5.

Is it still possible to manually override a user password? if so, is there a way you could create a known password hash for me?


author: Brant Schroeder
body: I was able to get it to work on our test instance which is also on Windows. I used a fairly simple password to ensure I did not use any possible reserved characters. When I logged in with recovery_admin and the password it worked.

I would suggest trying one more time to see if maybe something was missed or maybe Confluence just did not like it the first time.

Is the admin account associated with an email account where you could just recover the account through the normal password recovery option?

To answer your other question I am not sure about the hash. You would have to contact Atlassian support. <https://support.atlassian.com/contact/> My guess is this is no longer an option but I am not sure.


author: Elaina_Hall
body: Brant,

The instructions indicate that you need to launch confluence from the commandline line to enable recovery mode, is that correct? or can I just start the service via windows services?


author: Brant Schroeder
body: Needs to be done via command line. I don't think it will work if you do it via the service or they would document it. It would also need to be placed in the service Java options under the service Java tab or it would be ignored.


author: Elaina_Hall
body: Brant,

Still no luck, I edited:

```
C:\Program Files\Atlassian\Confluence\bin\setenv.bat
```

Updated the contents to have the following line:

```
set CATALINA_OPTS=-Datlassian.recovery.password=help %CATALINA_OPTS%
```

launched start-confluence:

```
c:\Program Files\Atlassian\Confluence\bin>start-confluence.bat

To run Confluence in the foreground, start the server with start-confluence.bat
/fg
2020.04.21_13.33.20
2020.04.21_13.33.20
If you encounter issues starting up Confluence, please see the Installation guid
e at http://confluence.atlassian.com/display/DOC/Confluence+Installation+Guide
"---------------------------------------------------------------------------"
"Using Java: C:\jre\bin\java.exe"
Error: Unable to access jarfile c:\Program
Error: Unable to access jarfile c:\Program
"---------------------------------------------------------------------------"
Using CATALINA_BASE: "c:\Program Files\Atlassian\Confluence"
Using CATALINA_HOME: "c:\Program Files\Atlassian\Confluence"
Using CATALINA_TMPDIR: "c:\Program Files\Atlassian\Confluence\temp"
Using JRE_HOME: "C:\jre"
Using CLASSPATH: "c:\Program Files\Atlassian\Confluence\bin\bootstrap.jar;
c:\Program Files\Atlassian\Confluence\bin\tomcat-juli.jar"
c:\Program Files\Atlassian\Confluence\bin>
```

In a browser navigated to:

```
http://localhost:8090/login.action
```

try logging in with the account:

```
user: recovery_admin
pass: help
```

I'm still not able to log in, am I missing something? (I feel like I'm following the steps verbatim.)


author: Brant Schroeder
body: No that looks correct. Are you seeing anything in the logs?


author: Elaina_Hall
body: Should there be anything in the logs to indicate that confluence is starting in recovery mode?


author: Elaina_Hall
body: Brant,

I just noticed something interesting. When I start confluence as a service I get the following log files:

```
atlassian-synchrony-proxy.log
catalina.*.log
commons-daemon.*.log
confluence040316180303-stderr.*.log
confluence040316180303-stdout.*.log
gc.log.0.current
host-manager.*.log
localhost.*.log
manager.*
```

But when I start confluence from the command-line I only get the following logs:

```
atlassian-synchrony-proxy.log
catalina.*.log
gc-2020.04.21_17.38.50.log.0.current
host-manager.*.log
localhost.*.log
manager.*.log
```

In both instances the confluence login page becomes available, is this expected behavior? or is something going wrong while starting from the command-line?

Thanks,

Elaina


author: Brant Schroeder
body: Elaina,

I am not positive on what the differences mean. I tried again last night and was able to get it to work so something is different in your environment. I added the set CATALINA_OPTS=-Datlassian.recovery.password=help at the very end. You could always add it as a property to your service startup option and see if that works. <https://confluence.atlassian.com/adminjiraserver072/setting-properties-and-options-on-startup-828788225.html?_ga=2.53897640.1446145428.1587395796-2108615180.1583600299>

You will still need to start manually. I would also suggest if that does not work to submit a support ticket to Atlassian. <https://support.atlassian.com/contact/#/>