TL;DR: When you lose the FortiGate admin password, you can reset it via console cable using the maintainer user and the password format bcpb<serial-number>. Important: In FortiOS 7.0.2 and later, the admin-maintainer feature is disabled by default. If it’s disabled, you must factory reset and restore from backup.

Which method for which case?

FortiOS version	Maintainer + bcpb method	Notes
5.0 – 5.6.x	✅ Works	60 seconds login window
6.0.x – 6.2.x	✅ Works	30 seconds login window
6.4.x – 7.0.1	✅ Works	14 seconds login window
7.0.2 and later	⚠️ Disabled by default	Requires set admin-maintainer enable set beforehand

Method 1 — Reset using Maintainer + bcpb account

This is the classic and reliable method. FortiGate allows a special user named maintainer to log in via console for a brief window during each boot. The password format is fixed: the prefix bcpb followed by the device serial number.

1. Find the device serial number. It’s printed on the bottom or back label of the device (example format: FGT60E4Q17012345). If you can’t reach the label, get it from your recorded inventory.
2. Connect the console cable to the device and open your terminal software. The correct baud rate (9600) is critical — wrong baud means garbled characters.
3. Power cycle the device (hardware reboot). Boot messages will start flowing.
4. When boot completes, the FGTXXX login: prompt appears. You have a 14–60 second window here (version dependent).
5. Type maintainer as the username and press Enter.
6. Type bcpb + serial number as the password. It is case-sensitive. Example: if the serial is FGT60E4Q17012345, the password is bcpbFGT60E4Q17012345.
7. If login succeeds, you drop into the CLI with admin privileges. Now reset the admin password:

config system admin
edit admin
set password <new-password>
next
end

8. Type exit and log in again with the admin account using the new password.

Method 2 — Status check for FortiOS 7.0.2+

Starting with FortiOS 7.0.2, the admin-maintainer feature is disabled by default for security. In this case, maintainer + bcpb attempts are rejected. To check whether it was enabled beforehand, look at the previous configuration backup for:

config system global
    set admin-maintainer enable
end

If this line is missing from your backup, or set to disable, Method 1 will not work. Proceed to Method 3.

Method 3 — Factory reset (last resort)

On devices where the maintainer account is disabled or was never enabled, you can factory reset at the cost of losing the current configuration. If you don’t have configuration backups, do not proceed without contacting support first.

1. Connect via console as in Method 1.
2. Reboot the device and press Ctrl+C or Ctrl+B when prompted (model-dependent) to enter the boot menu.
3. From the boot menu, run “Format boot device” followed by “Reset to factory default”.
4. When the device boots with factory settings, log in with the default credentials: username admin, password empty (just press Enter).
5. On first login, the device will require you to set a new password.
6. Restore your previously backed-up configuration: execute restore config tftp <file> <tftp-server>

Common issues

• “Login incorrect” error. Verify the serial number — case matters. Some models use lowercase letters in the serial, but the password prefix is always bcpb.
• No login prompt at all. Wrong baud rate. Try 115200 in addition to 9600 on newer models.
• “Password” not asked after maintainer. This is FortiOS 7.0.2+ with admin-maintainer disable. Proceed to Method 3.
• Window too short to type. Have the username and password ready in clipboard. Type maintainer and Enter immediately when the prompt appears, then paste the password.

Preventive recommendations

• On production devices, keep admin-maintainer disabled and take regular configuration backups.
• Manage admin passwords with a team password vault (1Password, Bitwarden, KeePass).
• Create a second admin account (e.g. backup-admin) and give it to a different person.
• Use FortiAuthenticator or RADIUS integration for centralized identity management.

Tested versions: FortiOS 6.4.13, 7.0.14, 7.2.8, 7.4.3 — This article has been verified on FortiGate 60E, 100F, 200F, and 600E models.