Locked Out of a Second-Hand Server? Reset iDRAC, iLO, IPMI and CIMC Passwords Safely

Short answer: first look for the default login on the server's own label, because Dell, HPE, Supermicro and Cisco each print or document a default. If a previous owner changed it, every vendor has a documented reset, but each one needs either physical access to the machine or a login to the operating system running on it: Dell through the F2 iDRAC Settings utility or local RACADM, HPE through hponcfg, the iLO security switch or the UEFI iLO utility, Supermicro through ipmitool or IPMICFG, and Cisco through the F8 CIMC utility at boot. Do this only on hardware you own.

This guide is for IT admins and small business owners in India who bought a used or refurbished server and are searching for the iDRAC default password, how to reset an iDRAC password, the iLO default password, how to reset an IPMI password on Supermicro or how to reset CIMC. Every default, command and menu path below was read from the vendor's own pages on 31 October 2026. Our advice is labelled as ours. For what the four controllers are and which licence you need, read our iDRAC vs iLO vs IPMI vs IMM guide first.

Which login should you try first? Defaults by brand

Look at the machine before you try anything. Each vendor puts the first-login details on the chassis or the board.

A refurbished server has usually been configured by at least one previous owner, so the defaults often no longer work. That is normal, and the reset routes below exist for exactly this.

Before you reset anything

1. Confirm you own it and that the seller agrees. Keep the invoice with the serial number. If the server is on a trial or return period, tell the seller you are resetting the controller.
2. Know what a reset erases. HPE warns that resetting iLO to factory defaults erases all iLO settings, including user and licence data, configuration, network settings and logs, although a factory-installed licence key is retained. Plan to re-enter the management IP address afterwards.
3. Check the licence situation. Features such as the virtual console can depend on a licence tier, which our controller guide explains. A reset gets you back in; it does not add licences.
4. Work from the model's own guide. Menu names change between generations. The steps below are what the vendors publish, and your generation's manual is the final word.

How do you reset a Dell iDRAC password?

Dell documents several ways to get back into an iDRAC. These are the two that suit a used server, one that needs physical access and one that needs a login to the operating system.

1. From the F2 System Setup (physical access, keyboard and monitor). In Dell's iDRAC9 guide: reboot the server and press F2, open iDRAC Settings, click Reset iDRAC configurations to defaults all, confirm with Yes, then click Back and Finish. The server restarts once the iDRAC settings are back at their defaults. Dell's support article also lists F2 as the way to reset the password through iDRAC settings.
2. From the operating system (local RACADM, needs an operating system login). With RACADM installed on the host, Dell lists racadm racresetcfg to reset the iDRAC configuration to factory default, and racadm racresetcfg -rc to reset the configuration and set the user back to root with the legacy password calvin.

Two details decide which command you want. Dell says that resetting iDRAC to factory defaults reverts the password to the one the server shipped with, which is the unique password on the Service Tag unless calvin was chosen at order. If that tag is missing, the -rc form returns to root and calvin. Dell also cautions that moving the system board jumper to make calvin the permanent default cannot be undone: you cannot go back to the unique password even after a factory reset.

Dell's other documented routes include the server management USB port and OpenManage Mobile, listed in the same iDRAC9 guide section. After you log in with the default credentials, iDRAC shows a Default Password Warning (message SEC0701) and a Force Change Password screen on supporting versions, so change it then.

How do you reset an HPE iLO password?

HPE documents three routes, and which one fits depends on whether you can log in to the operating system and which generation the server is.

1. From a running operating system (hponcfg). HPE's support article for iLO 3, 4 and 5 shows how to use the hponcfg utility to reset the Administrator password in band. You write a short XML script that modifies the Administrator user's password and run hponcfg -f passwd_reset_ilo.xml -l log.txt on the host, and HPE's article says the script succeeded when you can sign in with the new password. This route needs a login to the operating system. Follow HPE's article for the exact script.
2. The iLO security switch (physical access, Gen10 and newer). HPE's Compute Security Reference Guide says that on Gen10, Gen10 Plus and Gen11 servers the iLO security position (position 1) of the system maintenance switch provides emergency access to an administrator with physical control of the system board. It is sometimes called the iLO Security Override switch. The switch is inside the chassis: you must take the server offline, power it down and remove the access cover, and the settings are on the access panel label. When iLO uses the Production security state, enabling the switch disables login credential checks. In the High Security, FIPS and CNSA states, credentials are still enforced. iLO shows a warning on its web pages, records a log entry and sends an alert if an SNMP destination is set. Gen12 servers use the same switch for a different default-password recovery process described in the iLO 7 guides.
3. Factory-default reset from the iLO 5 Configuration Utility. HPE's iLO 5 guide describes resetting iLO to factory defaults with the iLO 5 Configuration Utility, which you reach through the server's UEFI System Utilities. It erases all iLO settings, including users, licence data, network settings and logs, and a factory-installed licence key is kept. After the reset you log in with the default credentials on the serial label pull tab.

The same HPE guide lists two more maintenance switch positions for used servers: position 5 removes configured BIOS administrator and power-on passwords, and position 6 restores BIOS factory defaults. If a used server also asks for a BIOS or power-on password, that is a separate lock from the iLO one. For Gen9 and older servers, which includes the popular DL380 Gen9, check the maintenance and service guide for your model for the switch position, because the generation-specific guide is the authority. Our DL380 generation guide explains what iLO version each generation has.

How do you reset a Supermicro IPMI (BMC) password?

What you do depends on the board's age and on whether you can reach the operating system.

1. Read the sticker first (X10, X11, H11, H12 and later). The password is a unique string of exactly 10 uppercase letters. Supermicro says that if the chassis sticker and the motherboard sticker disagree, the motherboard sticker is always the correct one.
2. Change it from the host operating system with ipmitool. The open source ipmitool program supports ipmitool user list to show user IDs and ipmitool user set password <user id> [<password>] to set a new password. Its -I open interface talks to the local controller through the operating system's IPMI driver, so it works when you are root on the server but locked out of the web interface. List the users first, because the ID of the admin account differs between boards.
3. Use Supermicro's own tools. Supermicro's guide says you can change the unique password in the IPMI web interface or with the IPMICFG command line tool from its website, and it provides a sample script that resets the BMC unique password to ADMIN or sets one of your choice. The script download sits behind a user agreement on Supermicro's BMC password page.

One board-specific behaviour is documented by Supermicro. On X9 DP motherboards that were given a unique password, loading the BMC factory defaults, or flashing the BMC firmware without preserving settings, sends the password back to ADMIN. Supermicro's FAQ describes this as X9 DP behaviour, so check your board's generation before you rely on it.

How do you reset a Cisco CIMC password?

Cisco's C-Series installation guides describe the Cisco IMC Configuration Utility, which is the local way in on the UCS C-Series rack servers that appear on the refurbished market.

1. Connect a monitor and keyboard and reboot the server.
2. When prompted during boot, press F8 to open the Cisco IMC Configuration Utility. The default user name is admin and the default password is password, and the first time you enter the utility you are prompted to change the default password.
3. If you cannot sign in, the utility has a Factory Default check box. Cisco's guide says that if you check it, the server reverts to the factory defaults. Save, and let the server restart.
4. Sign in with admin and password, then change the password at once.

Cisco's own Field Notice FN 64093 adds one wrinkle: units built between 17 November 2015 and 6 January 2016 shipped with admin and Cisco1234 as the first login. Try that before you reset. Factory defaults also return the network settings, so have the IP details ready. Other tricks you may see in forum threads are not documented by Cisco, so we have not listed them here.

After you are back in: lock the controller down

A management controller can reboot a server, mount media and open a remote console, which is why it is worth five minutes of care. The first two points come from the vendors' guidance and the rest are our advice.

1. Change the default password now. Dell says the default iDRAC username and password are widely known, and it shows a warning while defaults remain.
2. Never expose the controller to the internet. Dell says an iDRAC with default credentials is even less secure when it is internet-accessible. CISA's alert on IPMI (an archived alert, last revised in 2016) says to restrict IPMI traffic, usually UDP port 623, to a management VLAN with strong network controls, to use strong unique passwords, to enable encryption where possible and to disable cipher 0 and anonymous logins.
3. Put the management port on its own network. Use a separate VLAN or a VPN, with a firewall rule that only allows your admin machines. Our network security guide covers segmentation.
4. Audit what the previous owner left. Open the user list and delete accounts you do not recognise, check directory service, SNMP and alert destination settings, and remove old email recipients. A factory reset clears most of this, but check it anyway.
5. Update the firmware. Do this before the server goes into production, and note the version.
6. Record the new credentials properly. Use a password manager, and keep a photo of the service tag or label in your asset record.

Our Linux server hardening checklist covers the operating system side. Resetting a controller is not a disk wipe. If you also need the previous owner's data off the drives, read our data wiping guide.

What to ask a seller before you buy a used server

Most lockouts can be avoided with a few questions at the time of purchase. Ask these, in writing:

• Which management controller and licence tier does this exact unit have? Our controller guide explains what to expect.
• Has the management controller been reset to defaults, and will the default login be provided at delivery?
• Is the pull-out service tag or serial label with the default password still on the chassis? For Supermicro, are both password stickers present?
• Which firmware version is on the controller and the BIOS?
• What does the warranty cover, and can you check it by serial number? See how to check server warranty by serial number.

When the server arrives, run through our post-delivery testing checklist and the refurbished server buying checklist. Reliability questions are covered in Are refurbished servers reliable?

Frequently asked questions

Ask us about the exact server before you order

Tell us the make and model you are considering and we will tell you which management controller it has and what to expect at first login. We supply tested refurbished servers with a 1-year warranty and offer server AMC for ongoing support. Browse the shop, see Cisco servers and Supermicro servers, or call or WhatsApp +91-87962-44410, or contact us.

Sources, all read on 31 October 2026: Dell, PowerEdge: iDRAC default username and password guide, How to configure the iDRAC, the iDRAC9 User's Guide on resetting the default password, the iDRAC9 Security Configuration Guide, Secure Default Password and the iDRAC9 guide on setting calvin permanently. HPE, iLO 5 User Guide, default DNS name and user account, resetting iLO to factory defaults, the Compute Security Reference Guide, system maintenance switch and How to reset the iLO inband Administrator password. Supermicro, BMC Unique Password Security Feature, the BMC Unique Password Guide and FAQ 31582. Cisco, UCS C220 M5 Installation and Service Guide and Field Notice FN 64093. ipmitool, source and manual. CISA, Risks of Using the Intelligent Platform Management Interface (IPMI). Menus and commands change with firmware, so check the guide for your generation before you reset.