# Resetting admin, user and Run As passwords

*Tableau Server Administrator Study Guide · Troubleshooting · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-server-administrator/troubleshooting/resetting-admin-user-and-run-as-passwords*

How to recover a lost initial server administrator with tsm reset and tabcmd initialuser, reset Tableau user passwords with the REST API or the directory, and update, verify or replace the Windows Run As service account and its password.

- Certification: Salesforce Tableau Server Administrator
- Exam section: Troubleshooting
- Study guide: https://www.certifyforce.com/study-guide/tableau-server-administrator

**Official exam objective:**

> 4.2 Understand how to: 4.2.1 Reset passwords for a Tableau user or Tableau Run-As Service account; 4.2.2 Package log files for reporting; 4.2.3 Use tsm to validate site resources; 4.2.4 Rebuild the search index; 4.2.5 Use maintenance analysis reports; 4.2.6 Create/open support requests.

## What the exam expects

- Recover access when the initial server administrator's password is lost, including on an Active Directory server and when the old username must be kept.
- Update the Run As service account password after a directory rotation, on a single node or a cluster, with the TSM web UI or CLI.
- Diagnose a failed Run As password update and apply the Microsoft Services console workaround.
- Replace one domain Run As account with another, and know what to clean up afterward.
- Decide when the REST API Update User method can reset an ordinary Tableau user's password, by identity store.

Key terms:
- **Initial server administrator:** the first Tableau Server administrator, created at the end of installation with `tabcmd initialuser`.
- **`tsm reset`:** the TSM command that clears the initial admin user so a new one can be created.
- **Run As service account:** the Windows account Tableau Server services run as, by default NT AUTHORITY\NetworkService.
- **Tableau Server Services Manager:** the Windows service whose Log On password the Services console workaround updates.
- **Update User:** the REST API method that updates a Tableau Server user; under local authentication it can change name, email, password or site role, under Active Directory only display name, email and site role, and on Tableau Cloud not the password.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| `tsm reset` | Clears the initial admin user; the new admin's name cannot repeat the previous one | [tsm reset](https://help.tableau.com/current/server/en-us/cli_reset_tsm.htm) |
| `tsm reset --request-timeout` | Default 1800 seconds (30 minutes) | [tsm reset](https://help.tableau.com/current/server/en-us/cli_reset_tsm.htm) |
| `tabcmd initialuser` | Creates a Server administrator, not a TSM administrator; runs on the initial node | [tabcmd Commands](https://help.tableau.com/current/server/en-us/tabcmd_cmd.htm) |
| Directory identity store | The new initial admin must match a directory account | [tsm reset](https://help.tableau.com/current/server/en-us/cli_reset_tsm.htm) |
| Run As password in a cluster | Update with TSM on the initial node only | [Change the Run As Service Account](https://help.tableau.com/current/server/en-us/runas_acct.htm) |
| `service.runas.password` result | Validated with Active Directory; TSM reports no success or failure | [Change the Run As Service Account](https://help.tableau.com/current/server/en-us/runas_acct.htm) |
| Degraded after update | `tsm configuration get -k service.runas.password` shows the stored value | [Change the Run As Service Account](https://help.tableau.com/current/server/en-us/runas_acct.htm) |
| Services console workaround | Tableau Server stopped; repeated on every node in a cluster | [Change the Run As Service Account](https://help.tableau.com/current/server/en-us/runas_acct.htm) |
| Switching domain accounts | NetworkService first; two restarts, so off hours | [Change the Run As Service Account](https://help.tableau.com/current/server/en-us/runas_acct.htm) |
| Old account after a switch | Permissions remain until revoked manually | [Revoke Run As Permissions](https://help.tableau.com/current/server/en-us/runas_change.htm) |
| Update User and passwords | Can set a password under local authentication; cannot under Active Directory | [Users and Groups Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm) |

## Check yourself

- Why run `tsm pending-changes list` after setting the Run As password from the CLI?
- When does Tableau Server set the local computer permissions for a newly entered Run As account?
- Why must the Run As account keep its default Active Directory read and query permissions?
- How long does `tsm reset` wait for the command to finish by default?

## Sources

- [tsm reset](https://help.tableau.com/current/server/en-us/cli_reset_tsm.htm)
- [Sign in to the Tableau Server Admin Area](https://help.tableau.com/current/server/en-us/sign_in_server_admin.htm)
- [tabcmd Commands](https://help.tableau.com/current/server/en-us/tabcmd_cmd.htm)
- [Change the Run As Service Account](https://help.tableau.com/current/server/en-us/runas_acct.htm)
- [Revoke Run As Service Account Permissions](https://help.tableau.com/current/server/en-us/runas_change.htm)
- [Users and Groups Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Tableau Server Administrator pack (USD $19): https://www.certifyforce.com/practice-exams