# How to change the APPS password in Oracle EBS with FNDCPASS > Source: https://netray.co/erp-help/ebs-fndcpass-change-apps-password-how-to > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: ERP Help ## Short answer Use FNDCPASS with the APPLSYS mode to change the APPLSYS and APPS passwords together, ORACLE mode for a product schema such as GL, and USER mode for a front-end user such as SYSADMIN. In R12.2 the APPS change must also be applied to the WebLogic data sources, or the application tier cannot connect. ## Kind how-to ## System oracle-ebs ## Erp Oracle E-Business Suite ## Module System Administration / Security ## Query How to change the APPS password in Oracle EBS using FNDCPASS ## Alternate Queries - FNDCPASS syntax APPLSYS SYSADMIN USER - change APPS password R12.2 AFPASSWD - reset SYSADMIN password oracle apps - FNDCPASS ORACLE schema password change GL ## Applies To Oracle E-Business Suite 11i, R12.1 and R12.2 (R12.2 has extra steps for WebLogic and the adop file systems) ## Steps ### Change the APPS password safely **Items:** - Schedule downtime and tell users: all services connect as APPS, so a mismatch stops everything. - Stop the application tier services, or at least concurrent managers and OACore, so no process holds the old password. - Back up the FND_ORACLE_USERID and FND_USER data and note the current passwords in your secure vault. - On the application tier, run FNDCPASS apps/ 0 Y system/ SYSTEM APPLSYS . - Update the new password in the places that store it, which in R12.2 includes the WebLogic data source configuration for the EBS domain. - Start the services, then test a login, a form that opens, and a concurrent request that completes. - Record the change and confirm any external integrations that use the APPS account are updated. ## Sections ### The four FNDCPASS modes **Body:** FNDCPASS takes the connect string for APPS, the 0 and Y flags, then a second login and a mode. SYSTEM mode is used with the DBA login system/. In APPLSYS mode it changes the APPLSYS password and also the APPS password, because APPS is tied to APPLSYS in the Applications password scheme. ORACLE mode changes one product schema password, for example GL or AP, and USER mode changes an application user password such as SYSADMIN. Changing only APPS directly in the database with ALTER USER leaves FND_ORACLE_USERID out of sync and breaks the product schema password lookups. Always use FNDCPASS or the supported utility for the version you run. Passwords are validated against the database password profile, so a password that violates the profile can fail the whole change. Pick one that meets the complexity rules and avoids characters that the shell treats specially. **Code:** - FNDCPASS apps/ 0 Y system/ SYSTEM APPLSYS - FNDCPASS apps/ 0 Y system/ ORACLE GL - FNDCPASS apps/ 0 Y USER SYSADMIN ### R12.2 specifics: WebLogic data source and AFPASSWD **Body:** R12.2 adds a WebLogic tier. The EBS domain has JDBC data sources that store the APPS password, so after FNDCPASS you must update those data sources. Oracle's documented approach uses the Oracle WebLogic administration console or the supported scripts in the Oracle E-Business Suite documentation for the release, followed by a restart of the managed servers. R12.2 also provides AFPASSWD as the supported utility to change passwords, including support for the multi-tier case where the password must be changed consistently. Use the method named in the current Oracle note for your patch level, and follow the order exactly. Because R12.2 has two file systems for online patching, check that nothing in the patch file system is holding connections open during the change, and do not change passwords during an active adop cycle. ### Resetting a user password **Body:** To reset SYSADMIN or another user whose password is lost, FNDCPASS USER mode changes the password directly and works even if the user form is not reachable. When you can still log in as an administrator, the Users form under Security > User > Define lets you set a new password and require a change on next login by clearing the password expiry fields. The user-facing rules come from profile options such as Signon Password Length and Signon Password Hard To Guess, plus the Password Lifespan Days setting. A reset that is rejected is usually breaking one of these rules. Do not share the SYSADMIN password between people. Create named administrator accounts with the System Administrator responsibility and keep SYSADMIN for emergencies. **Code:** - SELECT user_name, start_date, end_date, password_lifespan_days FROM apps.fnd_user WHERE user_name = 'SYSADMIN'; ### Where else the APPS password lives **Body:** Even after a clean FNDCPASS run, other components may hold the old password. Typical places are database links from other databases, custom scripts and cron jobs, BI or reporting tools that connect directly, integration middleware, and wallet or credential stores. Search your deployment repositories and scheduler definitions for the APPS account before the change. Anything found should move to a service account with only the privileges it needs, rather than continuing to use APPS. After the change, check the alert log and the Apache and WebLogic logs for ORA-01017 invalid username or password messages, which show which component still has the old value. ## Pitfalls - Changing APPS with ALTER USER instead of FNDCPASS, leaving FND_ORACLE_USERID out of sync. - Skipping the WebLogic data source update in R12.2 so the application tier cannot connect. - Changing the password during an active adop patching cycle. - Using shell special characters in the password and having the command parsed incorrectly. - Leaving custom scripts and integrations connecting as APPS with the old password. - Not recording the old and new values in a vault before the change. ## Ai Angle An assistant grounded in your EBS environment can list which users and database links reference the APPS account, show password profile settings and expiry for administrator users, and draft a change checklist for your release. It never needs the password itself and does not run FNDCPASS. The change stays a controlled human step. ## Faq ### Does FNDCPASS APPLSYS change the APPS password too? **Answer:** Yes. In APPLSYS mode it changes the APPLSYS password and the APPS password together, since they are linked in the Applications password scheme. After the change you must update every component that stores the APPS password. ### Can I just use ALTER USER APPS IDENTIFIED BY? **Answer:** No. That changes the database account but not the Applications records in FND_ORACLE_USERID, so the application cannot validate product schema passwords afterward. Use FNDCPASS, or AFPASSWD where your release supports it. ### How do I recover a lost SYSADMIN password? **Answer:** Run FNDCPASS in USER mode with the APPS login to set a new SYSADMIN password directly, then log in and create named administrator accounts. If you cannot run FNDCPASS, a DBA can use the supported database procedure for your release. ### What breaks if I forget the data source in R12.2? **Answer:** The managed servers keep trying the old password and the application tier fails to connect, so logins and forms stop working. The WebLogic logs show ORA-01017 errors. Update the data sources and restart the managed servers. ## Search terms FNDCPASS, change APPS password, FNDCPASS syntax, AFPASSWD R12.2, reset SYSADMIN password, oracle apps password change, ORA-01017 EBS after password change, WebLogic data source APPS password, oracle ebs security --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json