Most Cisco engineers are aware of the classic Password-Recovery service Cisco equipment have. If the device's credentials are lost, then performing the Password-Recovery procedure will effectively provide full access to the device's configuration.

By disabling the Password-Recovery service you prevent anyone with physical access to the device (e.g console port) from performing the Password-Recovery process and obtaining access to its configuration.

Disabling the Password-Recovery service requires extreme attention because should you loose your password, there is no turning back. It is highly advisable to always keep a backup of your configurations in a secure area - just in case.

You will also notice that the 'no service password-encryption' command will not show up when hitting '?' (for help) as this command is undocumented in the IOS help.

Following are the steps to disable the Password-Recovery service and the message confirmation shown when the device boots up after the Password-Recovery service is disabled:

Article Summary

This article explains the password-recovery service and how to disable it on a Cisco device.

If you have found the article useful, we would really appreciate you sharing it with others by using the provided services on the top left corner of this article. Sharing our articles takes only a minute of your time and helps Firewall.cx reach more people through such services.