Cisco

Cisco WS-C3650-48TS Password Recovery

Step-by-step password recovery for the Cisco WS-C3650-48TS (Catalyst 3650 (IOS-XE)). Console access required.

Overview

This guide provides step-by-step instructions for resetting lost or forgotten administrative passwords on enterprise networking hardware. Follow the procedure below carefully to regain access while preserving your device configuration.

Prerequisites

Before proceeding with password recovery, ensure you have a console cable, terminal emulation software configured to 9600 baud, and physical access to the device.

Step 1: Establish Console Connection

Connect your terminal cable to the console port of the device and open your serial terminal session.

Step 2: Interrupt the Boot Sequence

Power cycle the hardware and issue a Break key sequence during initial system startup to enter ROMMON mode.

Step 3: Reset Password & Configuration

Bypass startup configuration loading, boot into system software, set your new credentials, and save changes back to non-volatile memory.

Overview

This procedure recovers administrator access to the Cisco Catalyst 3650-48TS (IOS-XE) when the enable secret or local user passwords are lost. The startup configuration is preserved (renamed, not erased).

Prerequisites

Console cable (RJ-45 to DB-9 or USB) with a terminal session at 9600 baud, 8N1. Physical access to power-cycle the switch and reach the Mode button on the front panel.

Recovery Procedure — Mode Button Method

Connect the console cable and open a terminal session (9600 8N1).
Power-cycle the switch.
Within 15 seconds of power-on, press and HOLD the Mode button on the front panel. Keep holding until the system LED turns solid amber (roughly 10–15 seconds), then release. A brief press does nothing.
The switch enters the boot loader and shows the switch: prompt.
Initialize flash: flash_init
List flash contents: dir flash: — locate config.text (on stacked units: config.text-1, config.text-2, ...).
Rename the configuration: rename flash:config.text flash:config.text.old (use the correct per-member name if stacking).
Boot the switch: boot — if the image is not auto-discovered, use boot flash:packages.conf.
The switch boots to the CLI with an empty configuration. Enter enable (no password).
Restore the config: copy flash:config.text.old system:running-config — enter flash:config.text.old as the source filename when prompted.
Enter configuration mode: configure terminal.
Set a new enable secret: enable secret <new-password>.
Set line passwords: line vty 0 15 → password <new-password> → login; repeat for line console 0. If local users are used (username/password), reset them too: username <name> privilege 15 secret <new-password>.
Exit and save: end, then write memory.
Reload and verify: reload. Log in with the new credentials.

Important Notes

The config is renamed, not erased — restore it in step 10 and re-save in step 14.
IOS-XE switches (3650/3850) use packages.conf as the boot image — the switch: prompt's boot command auto-discovers it, but boot flash:packages.conf is the explicit form.
On stacks, config files are per-member (config.text-1, config.text-2, ...).
If no service password-recovery is configured, the Mode button will not bypass the config — only a factory reset (config erased) is possible.
Baud rate is 9600 on these platforms — do not use 115200.

Protecting Your Configuration

Before recovery, back up the config: copy running-config tftp://<server>/<filename> or copy running-config usbflash0:. After recovery, verify show startup-config and re-save.