Enable or disable password protection

You can restrict users from running critical sadmin commands by enabling password protection. When password protection is enabled, Application Control allows these critical commands to run only when the user enters the correct password.

Passwords are encrypted with the SHA-2 hashing algorithm. To protect password details, a random number is added to the password before the hash is computed. The SHA5012 encryption algorithm, a subset of SHA-2, generates a hash of 512 bits, which protects the password from rainbow table attacks.

If you don't need password protection, remove the password, which allows users to run all sadmin commands.

Type the sadmin passwd command to set a password.
When you set a password, users can no longer run critical commands without providing the correct password. Only a limited set of non-critical commands can run without the password.
You can use the -z switch to prevent the system from prompting for the password. It can be used in all CLI commands. For example, sadmin solidify -z <password> is used for unmanaged CLI operations, and is different from the password for the ePO - On-prem administrator used for CLI lockdown.
- If you already set the password, Application Control prompts you to enter your password. Type the old password and press Enter. You are now asked to set the new password and retype it.
- If you didn't set the password earlier, Application Control prompts you to enter a new password. Set the new password and retype it.
Type the sadmin passwd -d command to remove password protection.
This allows users to run all sadmin commands without requesting a password.
Press Enter.