For Symantec Endpoint Protection Manager (SEPM) 14 and newer, the legacy resetpass.bat tool has been officially removed from the installation directory. Users are instead required to use the built-in "Forgot your password?" link on the login console, which relies on a pre-configured email server.

If you are in an isolated environment without an email server, or if the resetpass.bat file is missing, you can manually recreate the script or use a "troubleshooting" method to capture the reset link locally. Method 1: Manually Recreate the resetpass.bat Script

While Symantec no longer includes this file, the command logic can still be executed. Copy the following code into a new Notepad file and save it as resetpass.bat in your ...\Symantec Endpoint Protection Manager\Tools folder:

Forgot Administrator Password for SEPM | Endpoint Protection

Q1: Can I download resetpass.bat from Broadcom’s official site?

A: No. Broadcom does not offer standalone resetpass.bat for download. It must be copied from an existing SEPM installation. If your server is completely inaccessible, you must restore from backup or reinstall SEPM and import a configuration backup.

What is resetpass.bat in SEPM 14?

resetpass.bat is a batch script utility bundled natively with Symantec Endpoint Protection Manager (version 14 and later). Its sole purpose is to reset the built-in administrator password (admin or symadmin) back to factory default without requiring a full database reset or reinstallation.

Key characteristics:

  • No external download required – It is installed locally with SEPM.
  • Command-line driven – Must be run from an elevated command prompt.
  • Safe for data – Does not delete policies, groups, or client communication settings.
  • Immediate effect – The password is reset instantly.

⚠️ Important: Despite the common search phrase "resetpass.bat download", you should never download this file from third-party websites. Doing so exposes your security console to malware, trojans, or tampered scripts. The legitimate file is already on your SEPM server.

Step-by-Step: Locating the Legitimate resetpass.bat

Before attempting any password reset, ensure you have physical or RDP access to the Windows server running SEPM 14.x. The batch file resides within the SEPM installation folder.

Using resetpass_with_file.bat

This variant writes the new password to a text file instead of displaying it on screen – useful for logging or automation:

resetpass_with_file.bat admin C:\temp\newpass.txt

3. Access Denied (0x80070005)

Cause: Command Prompt not elevated or insufficient NTFS permissions.
Fix: Right-click Command Prompt → Run as Administrator. Also verify the Services folder has proper SYSTEM access.

Default Paths:

| Installation Type | Path | |------------------|------| | 64-bit Windows default | C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin\ | | Custom installation | D:\SEPM\Symantec Endpoint Protection Manager\bin\ | | Older upgrade from 12.x | C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\ |

Inside the bin folder, you will find:

  • resetpass.bat
  • resetpass_with_file.bat (alternative version)
  • Various .vbs and .jar utility files.