Picture this: Your domain controller won’t start, Active Directory is corrupted, and you can’t log in with your domain credentials. Your only lifeline? The Directory Services Restore Mode (DSRM) password — the one you probably set years ago and promptly forgot.

The DSRM account is a local administrator account in Windows Server used to restore or repair the server’s Active Directory (AD) database. Think of it as the “break glass in case of emergency” account for your domain controllers.

In this guide, we’ll walk through exactly what DSRM is, why it’s a security risk if neglected, how to reset it using ntdsutil, and finally how to automate and secure it using Windows LAPS — complete with screenshots from a real lab environment.

What is Directory Services Restore Mode (DSRM)?

DSRM is a special boot mode available only on domain controllers. In DSRM, Active Directory services do not run, allowing you to perform offline maintenance on the AD database.

When you promote a Windows server to a domain controller, you’re prompted to set a DSRM administrator password. This password is for the local Administrator account used to log in while in DSRM mode. The DSRM account possesses full administrative rights on that specific domain controller, but not domain or network access rights.

Why is the DSRM Password So Important?

The Security Imperative

The DSRM password is incredibly powerful. With a weak or known password, someone with local access to the domain controller can reboot the server and copy or modify the Active Directory database without leaving any trace.

Compliance Requirements

Security benchmarks like STIG mandate that DSRM passwords must be changed at least annually. If not, it’s a compliance finding.

How to Reset the DSRM Password Using NTDSUtil

You don’t need to reboot into DSRM mode to change the password. In Windows Server 2003 and later, use the ntdsutil command-line tool while the DC is running normally.

Step-by-Step Password Reset

1. Open an elevated command prompt.
2. Type ntdsutil and press Enter.
3. At the Ntdsutil prompt, type set dsrm password.
4. To reset locally, type reset password on server null. For a remote DC, use reset password on server servername.
5. Type the new password when prompted (no characters will appear).
6. Type q twice to exit.

Lab Screenshot — NTDSUtil DSRM Reset

Using ntdsutil to securely reset the DSRM password without rebooting.

PowerShell One-Liner

ntdsutil "set dsrm password" "reset password on server null" q q

How to Verify Your DSRM Password

Your lab document shows the exact method to test the DSRM password using msconfig to force a DSRM boot.

Step 1: Configure Boot Options

Press Win + R, type msconfig, and go to the Boot tab. Select Safe Boot and Active Directory repair (DSRM).

Lab Screenshot — msconfig Boot Configuration

Configuring msconfig to boot into Directory Services Restore Mode for testing.

Step 2: Login with DSRM / Local Administrator Account

Reboot the server. It will automatically boot into DSRM mode. Log in using the local Administrator account (e.g., .\Administrator) with the DSRM password.

Lab Screenshot — DSRM Login

Successfully logging in with the DSRM local administrator account.

Step 3: Revert Back to Normal Boot

After verifying, open msconfig again, uncheck Safe Boot, and reboot normally to return to standard operation.

Lab Screenshot — Revert to Normal Boot

Reverting the boot configuration to standard (normal) startup.

Recommendation: Automate with Windows LAPS

What is Windows LAPS?

Windows Local Administrator Password Solution (LAPS) is a built-in Windows feature (Server 2019+) that automatically manages and backs up local admin and DSRM passwords on domain controllers.

Why Microsoft Recommends LAPS for DSRM

Prerequisites & Configuration

• Domain Functional Level 2016 or higher
• Windows Server 2019 or later (2016 and earlier do not support DSRM management via LAPS)
• Update AD schema: Update-LapsADSchema

GPO Path:

Computer Configuration -> Policies -> Administrative Templates -> System -> LAPS

Key GPO Settings for DSRM:

1. Enable password backup for DSRM accounts
2. Configure Password Backup Directory → Active Directory
3. Configure Authorized Password Decryptors
4. Configure password settings (length, complexity, expiration)

Retrieving the DSRM Password with LAPS

Get-LapsADPassword -Identity 'DC01' -AsPlainText

Lab Screenshot — LAPS Policy Implementation to Domain Controllers

Administrator can view the DSRM Password from ADUC Console of Multiple Domain Controllers.

Lab Screenshot — What happens after LAPS Policy Implementation to Domain Controllers and try to reset from NTDSUTIL above steps?

Administrator do not need to manage DSRM Password of multiple Domain controllers manually, GPO LAPS policy will take care of it.

Frequently Asked Questions