Jeff Wallace
Apr 3, 2012
(0 votes)

Forcefully Unlock Administrative User in EPiServer Commerce

Based on CMS 6 R2, Commerce 1 R2 SP1 (or SP2), and SQL Server 2008


So you went on vacation (or holiday depending on your country’s term for that time we all look forward to), had a long weekend, or just did a fresh install of EPiServer Commerce and either totally forgot or have no idea what your administrator users password is.  You try logging in with a variety of your favorite passwords without luck.  Unfortunately you realize you probably did this too many times and can no longer log in because your account has been locked due to excessive failed login attempts.  This is also the moment where you realize you probably should have created two or more admin users.  Oops!  If you have access to the database, have no fear, you can undo your wrong, get back to work, and not feel guilty having a few beers again next weekend and forgetting that password all over again.  Winking smile


Please note, the EPiServer Commerce Manager allows you to unlock users through the backend user interface which is the most typical approach in a real environment. This is for the case where you’ve locked your only administrator account, likely in a new install, demo environment, or something comparable.


  • Log into SQL Server Management Studio (assuming you’ve installed it, otherwise you’ll need to open up your favorite command line tool).
  • Navigate to the Commerce Manager database for the site with the locked user.
  • Expand the database and the “Tables” node.


  • Navigate to the “aspnet_Membership” table
  • Select the option to “Edit Top 200  Rows”.  (If you have more than 200 users use your preferred standard SQL methods to get to the locked user).


  • Locate the locked user and scroll the table to the right to find the “IsLockedOut” field.  If the user is locked it will be set to “True”.
  • Change this field to “False”


  • You should now be able to go back to your site and log in.



Apr 03, 2012


Apr 3, 2012 05:51 PM

If you forgot the password completely you can also use the stored procedure to set it to whatever you want: aspnet_Membership_SetPassword

Set the PasswordFormat to 0, to be able to pass in a clear text password:
exec aspnet_Membership_SetPassword

Apr 3, 2012 05:57 PM

Nice addition Tobias!

Apr 3, 2012 07:44 PM

Thanks for doing this, Jeff. And thanks for the added bonus, Tobias.

Justin Le
Justin Le May 20, 2015 10:17 AM

Thanks! noted to self

Please login to comment.
Latest blogs
Optimizely PIM - Variant Management Overhaul & Rollout

Optimizely PIM has completely overhauled variant management with improved usability and support for variant swatches. In order to enable this...

Arthur Vander Voort | Feb 4, 2023

You Just Got Vectored! SVG Image Formats

 If you're reading this, then you've come across a need that nearly all Opti developers encounter in their careers; You need to display a vector...

Greg J | Feb 3, 2023 | Syndicated blog

CMS Core 12.12.0 delisted from Nuget feed

We have decided to delist version 12.12.0 of the CMS Core packages from our Nuget feed. As a consequence, we are also temporarily delisting version...

Magnus Rahl | Feb 3, 2023

How Optimizely Web Experimentation enables fast validation of design and UX changes

Ever wondered how to increase conversion rates and quickly validate design/UX alternatives to find the most impactful changes? I wrote a practical...

Jacob Pretorius | Jan 31, 2023