How to Reset a Niagara Station Passphrase and Admin Password on a PC

Open the station's config.bog offline in Workbench, change the file's passphrase, reset the admin password, save, and copy the station back with the Station Copier.

You have been handed a Niagara station, perhaps from a previous integrator or an old project archive, and you do not have its passphrase or admin password. Without the passphrase Niagara cannot read the station's protected data, so it will not run on your machine; without an admin password you cannot change anything. If you hold the station files and are entitled to work on the system, you can regain control. This guide explains the passphrases in Niagara, the step-by-step reset, and what you must re-enter afterwards.

Passphrases and passwords in Niagara 4

When a station's file passphrase matches the passphrase on the host where it runs, the station starts without prompting. When it does not match, Niagara asks for the passphrase before it will run the station.

Before you start

• Make sure you are entitled to do this. The procedure is for engineers responsible for a system. If the station belongs to a client, have their authority in writing.
• Back up the original station files before changing anything. Keep the untouched copy.
• Understand the impact: changing a station file's passphrase clears every password stored in the station file (users, drivers, email, MQTT, REST and other connections). You will need to re-enter them all.
• Gather replacement credentials for anything the station connects to: email accounts, brokers, third-party systems, driver logins.

Step-by-step: reset the passphrase and admin password

Step 1: Open the station file offline

1. In Workbench, expand the local file system in the Nav tree: My Host > My File System > User Home > stations.
2. Open the station's folder and double-click config.bog.
3. The station opens in offline mode, editing the file directly rather than a running station.

Step 2: Change the file's passphrase

1. Click the padlock icon in the toolbar. It provides special actions for protected station files.
2. Choose Change the file's passphrase.
3. Enter a new passphrase. Use a strong one; to make the station run without prompting on this machine, use the passphrase configured on the host where it will run.
4. Click Update.
5. Save the BOG file.

All stored passwords in the file are now empty. The admin user still exists but must be given a known password.

Step 3: Reset the admin password

1. Expand Config > Services > UserService > admin.
2. Edit the Password property and set a new, strong password.
3. Save the BOG file. In Workbench, an unsaved BOG file is indicated by a different (yellow) state; make sure it shows as saved before moving on.

Step 4: Copy the station and start it

1. Open a platform connection to the host that will run the station (your PC for testing, or the supervisor).
2. Open the Station Copier.
3. Copy the station from your local user home to the host.
4. Choose Start after install, and decide whether Auto Start should be enabled.
5. Click Finish and wait for the station to show as running in the Application Director.

If the station's passphrase matches the host's, it starts without asking for a passphrase.

Step 5: Log in and re-enter cleared passwords

1. Open the station with admin and the new password.
2. Re-enter every cleared password: other user accounts, driver credentials, email accounts, MQTT brokers, REST and cloud connections, database connections.
3. Test each integration: check drivers go to {ok}, send a test email, confirm brokers connect.
4. Take a new backup and record the new passphrase and admin password securely.

Watch the "Niagara 4 Station Passwords" video in our advanced engineering guides to see the procedure on screen.

Changing the system passphrase on a PC

If you know the current system passphrase, you can change it from the host's platform administration in Workbench. On JACE 8000 and JACE 9000 controllers whose platform credentials and system passphrase are both lost, use the shell-mode reset described in how to generate a platform reset token, which resets them without deleting the station.

Common situations and the right fix

Working on a station that is running on a controller

If the locked station is running on a JACE or IONA:

1. Open a platform connection (you need platform credentials; see JACE default credentials).
2. Use the Station Copier to copy the station from the controller to your PC.
3. Reset the passphrase and admin password offline on your PC as described above.
4. Plan a short outage, then copy the station back to the controller with the Station Copier and start it.
5. Re-enter cleared passwords and test integrations.

Because the station on the controller will be replaced, take a full platform backup first.

Checklist of passwords to re-enter

Make a list as you go; it becomes part of the handover documentation.

Worked example: inheriting a supervisor

A facilities manager changes BMS contractor. The outgoing contractor does not hand over the supervisor's station passphrase or admin password. The new contractor, with the building owner's written authority:

1. logs in to the supervisor server with a Windows administrator account provided by the client's IT team and takes a copy of the station folder as a backup
2. stops the station in the Application Director
3. opens config.bog offline, changes the file's passphrase to the one configured on the server, and sets a new admin password
4. saves, copies the station back with the Station Copier and starts it
5. re-enters the passwords that were cleared: email account, the SQL database used for history archiving, and the Niagara network client credentials used to connect to each JACE
6. confirms histories, alarms and emails are flowing, then gives the client a sealed record of the new passphrase and admin credentials

Total outage: under an hour, most of it spent re-entering and testing integration passwords.

Station passphrase vs Niagara network credentials

A supervisor connects to each JACE using client credentials stored in its Niagara network configuration. Those are among the passwords cleared by a passphrase change, so after a reset on a supervisor, every JACE connection will fail until they are re-entered. Have the JACE station accounts used for supervisor connections ready before you start, or create new dedicated accounts on each JACE for the purpose.

Security and authority

The ability to reset a station's passphrase is powerful: anyone with a copy of the station files and Workbench can take control of the station they describe. Two consequences follow.

Protect station files. Backups and copies of station folders are as sensitive as the passwords they contain. Store them in access-controlled locations, not on shared drives or USB sticks left in plant rooms, and delete old copies from engineers' laptops when projects end.

Act with authority. Taking over a station is appropriate when you are the system's responsible engineer, or when the building owner has instructed you in writing. If a dispute exists between an owner and a previous contractor, make sure the owner's authority is clear before you start, and record what you did and when.

The passphrase protects stored credentials so that a stolen station file does not directly reveal passwords to other systems. That protection is preserved by the reset process: the stored passwords are cleared, not revealed.

Preventing this in future

• record the station passphrase, system passphrase, admin and platform credentials securely at commissioning
• give the building owner a copy, so a change of integrator never strands them
• keep at least two administrator accounts
• use LDAP or individual accounts rather than a shared admin login (see LDAP integration)
• store station backups with the passphrase recorded alongside (in the vault, not in the same folder)

Frequently asked questions

What happens if I change a station file's passphrase?

All passwords stored in the station file are cleared and must be re-entered, including users, drivers, email and broker credentials.

Can I reset a Niagara station admin password without the passphrase?

Yes, by opening the station file offline, changing the file's passphrase (which clears stored passwords), then setting a new admin password and saving.

Why does my station ask for a passphrase when I start it?

The station file's passphrase does not match the passphrase on the host. Enter it, or change the file's passphrase to match the host.

Is resetting the passphrase the same as resetting platform credentials?

No. The station passphrase protects data in the station file. Platform credentials protect access to the host. JACE platform credentials are reset through the shell-mode reset token procedure.

Will the station lose its points and logic?

No. Points, logic, graphics, histories configuration and services remain. Only stored passwords are cleared.

What is a good station passphrase?

A long passphrase of several unrelated words, unique to the site, stored in a password vault and shared with the building owner. Avoid reusing passphrases across sites.

Can I see the old passwords after resetting the passphrase?

No. Stored passwords are encrypted with the old passphrase and are cleared when it changes. You must obtain the credentials again from the systems they belong to.

Do I need a backup before doing this?

Yes. Always keep an untouched copy of the original station files before making changes.

Does resetting the passphrase affect histories and alarms?

No. History and alarm data are not cleared by changing the station file's passphrase; only stored passwords are.

Where are station files stored on a PC?

In the Niagara user home's stations folder for the relevant version. In Workbench, browse to My Host, My File System, User Home, stations.

Can I reset the passphrase on a running station?

Work on a copy of the station offline, then copy it back. Editing the files of a running station risks them being overwritten when the station saves.

Need help from a Niagara engineer?

If this guide has not solved the problem, contact the Tyrrell Products technical team on 01942 732819 or [email protected]. Tell us the controller or host type, its Niagara version and what you have already tried, and we will help you get the system running.

Related guides

• JACE default credentials
• How to generate a platform reset token
• Platform login failing
• LDAP integration