Documentation
Use Primentra
Getting Started
Data Grid
Approvals
Set up
Modeling
Business Rules
Users & Roles
Sign-in & Security
Install and run
Installation
Administration
Integration & API
Architecture
Migrate from MDS
Migrating from MDS

Account Recovery

On this page

Use this page when no administrator can sign in — every admin account is locked, forgotten, or gone. Both methods need access to the server itself. Neither can be triggered from a browser.

Try the ordinary routes first. Another administrator unlocks a single locked account. The Forgot password? link does not unlock it. See Account Security.

Option 1 — the command-line recovery tool

The recovery tool resets an existing account's password, enables the account and clears its lockout. It works on any account, even a disabled or locked one. It reads the database connection from the application's own config file and talks to SQL Server directly. The API server does not have to be running.

  1. Open Command Prompt or PowerShell on the server.
  2. Change to the Primentra installation folder.
  3. Run:
node scripts/recover-admin.mjs
Type the full command, including node. Do not double-click the file. Windows does not know how to run an .mjs file and asks which program to open it with.

The tool then:

  1. Prints the config path, the server, and the database it connected to.
  2. Lists every account with its email, name, status, failed-attempt count, and whether it is an administrator.
  3. Asks for the number of the account to reset.
  4. Asks for a new password of at least 8 characters, then asks you to confirm it.
  5. Saves the hashed password, enables the account, clears Locked out, and resets the failed-attempt counter to zero.
  6. Offers to add the account to an administrator role, if it is not in one already.

If the database contains no accounts at all, the tool offers to create a new administrator instead and asks for an email address, a display name, and a password.

New administrator rights take effect at the next sign-in.

Option 2 — force the setup screen

This creates a brand new administrator account through the ordinary first-run setup screen. Existing accounts are untouched.

  1. Open mds-config.json in the Primentra installation folder. Only an administrator can open this file, because it holds passwords. Open Notepad with Run as administrator, see Open mds-config.json.
  2. Set forceSetupScreen to true:
"forceSetupScreen": true
  1. Open Primentra in a browser. The Create your administrator account screen appears.
  2. Fill in the email, display name, and password, then click Create account & continue.
  3. The new account is added to the existing Administrators role and signed in.

Primentra sets forceSetupScreen back to false by itself once the account is created, so the screen is never shown to ordinary users.

The existing members of the Administrators role are kept. Adding a recovery admin does not remove anyone else.

When to use which

SituationUse
An administrator password is lostThe recovery tool
Every administrator account is lockedEither
You want a new administrator without touching existing accountsForce the setup screen
Routine password changeNeither — use the Users page

Why both need server access

A remote reset would be a way in for anyone who could reach the login screen. Requiring the file system or a command prompt on the server is what keeps that door closed.

Both actions are written to the audit log, so a recovery leaves a record.

Open mds-config.json

The file is in the Primentra installation folder, normally C:\Program Files\Primentra. It holds the database connection, the license key and the mail settings, with their passwords. Since version 1.2026.10.7, only the Primentra service and administrators can read it.

To open it:

  1. Click Start, type Notepad, right-click it and choose Run as administrator.
  2. Choose File › Open, go to the installation folder, set the file type to All files and open mds-config.json.

Without Run as administrator, Windows answers Access denied, also for an administrator account. After a change, restart the Primentra service.

What mds-config.json.bak is for

Primentra writes mds-config.json.bak next to the file just before every change. It is the last good copy of your settings. If a typo or a power cut damages mds-config.json, you copy the .bak over it (see below).

Do not delete the .bak. While it exists, a missing or broken mds-config.json never opens the first-time setup to anyone on the network.

If mds-config.json is broken

Make a copy of mds-config.json before you edit it by hand, as administrator (see above). A missing comma or brace makes the file unreadable.

If Primentra cannot read the file, every browser shows Configuration problem instead of the sign-in screen. The setup screens stay closed and nobody can save settings, so nobody can point Primentra at another database in the meantime.

The file name and the reason are in three places:

  • logs\service.err.log, in a line that starts with [config]
  • logs\errorlog.txt
  • the Windows Event Log, event ID 103. See Troubleshooting

To recover:

  1. Fix the JSON in mds-config.json, or copy mds-config.json.bak over it. Primentra writes that copy before every change to the file.
  2. Reload the page. You do not have to restart the service. Primentra reads the file again at the next request, and the log gets a line that says the file reads correctly again.

In Windows PowerShell 5.1, read the log with Get-Content logs\service.err.log -Encoding UTF8. Without -Encoding UTF8, dashes and arrows show as strange characters.

Deleting mds-config.json does not reset the installation while mds-config.json.bak exists. Primentra runs on the copy and still shows the configuration problem. The setup screen only appears when both files are gone.