Regain access when administration is locked out

The last administrator key blocked or expired, the rule verwaltung deleted, a Deny sign-in rule for administration, the phone with the second factor lost: then nobody can sign in to administration any more. The way out is commands on the server.

The commands run on the service's computer and work directly with the store file; for this, they need the rights of an administrator of this computer. A locked-out administration deliberately can't be opened over the network. admin-status first shows what's missing; the matching command fixes it. The running service picks up the change without a restart.

1. On the service's computer, open a command prompt or PowerShell as an administrator and change to the service's program directory.

2. Display who can administer and what the others are missing:

   .\Wkl.Data.Gateway.exe admin-status

3. Fix the cause:

   Cause	Command
   Phone with the authenticator app lost	.\Wkl.Data.Gateway.exe reset-totp --person "Jane Doe"—the person sets up a new factor at their next sign-in
   Key blocked or expired	.\Wkl.Data.Gateway.exe init-admin --name "Jane Doe" --force—issues a new key and shows it once
   Rule verwaltung deleted	.\Wkl.Data.Gateway.exe init-admin --name "Jane Doe" --force—creates the rule again
   A sign-in rule locks everyone out	.\Wkl.Data.Gateway.exe list-sign-in-rules, then .\Wkl.Data.Gateway.exe remove-sign-in-rule --id 3

4. Use admin-status to check that someone can administer again.

Result: an administrator can sign in to the administration app again.

• The second factor remains mandatory. Administration always requires it, even if the rule “Verwaltung nur mit zweitem Faktor” (Administration only with a second factor) was deleted (fixed lower bound RequireAdminTotp in the configuration file). After reset-totp, the person sets it up again at the next sign-in; a new key alone (including init-admin --force) keeps an existing factor; with --totp, it's done right in the console.
• Traces: each of these changes is recorded in the change log with Konsole (Rechner, Konto) (console (computer, account)).
• Prevention: create at least two administrators, and test a new sign-in rule with a second sign-in before you sign out.

• Create the first administrator
• Reference: First administrator and recovery