Netop Knowledge Base

Maintenance Password Rotation via NetopPwdUtil – Netop Host

Applies to: Netop Windows Host 13.09+    |    Audience: Administrators    |     Version: 1.0 (June 2026)

Overview

This article describes the supported use of NetopPwdUtil.exe to rotate the Netop Host maintenance password on Windows Host installations. It is intended for administrators who need to perform the change from customer-managed automation instead of the graphical user interface.

The rotation is performed locally on the target machine through non-interactive CLI execution. The administrator or automation process supplies the current maintenance password and the new maintenance password through standard input. Netop Host must be installed on the target machine, but the Host application does not need to be running when the password is changed. After a successful rotation, the new password becomes active for the Host.

Supported use

This feature is intended for single-host password rotation. It does not provide orchestration, mass rollout, or password generation. Password handoff is performed through stdin instead of NetopPwdUtil.exe command-line process arguments.

Not covered by this feature

• Netop Guest maintenance password rotation
• Linux or macOS Host maintenance password rotation
• Mass rollout or orchestration
• Netop-generated maintenance passwords
• Rotation through Security Server

Prerequisites

• Netop Host is installed on the target Windows machine.
• NetopPwdUtil.exe is available on the target machine.
• The Host application does not need to be running when the command is executed.
• The caller has sufficient local permissions and runs NetopPwdUtil.exe from an elevated administrator context.
  • For remote SSH, PuTTY, or Plink execution, the user must have administrator rights and run in an elevated context where UAC does not strip administrative privileges.
• The caller knows the current Host maintenance password.
• The new maintenance password has already been generated by customer tooling or selected according to the customer password policy.

Command usage

Command syntax

The older-shaped Host marker form is tolerated for compatibility, but the preferred public automation interface is stdin with /mpass and /setmpass.

Use the following preferred command format from an elevated administrator context:

'/mpass:<current-password> /setmpass:<new-password>' | .\NetopPwdUtil.exe

Equivalent cmd.exe form (Run as administrator):

echo /mpass:<current-password> /setmpass:<new-password> | NetopPwdUtil.exe

The app also tolerates the older-shaped Host marker form:

'/H /maintpwd:rotate /mpass:<current-password> /setmpass:<new-password>' |

.\NetopPwdUtil.exe

Example

echo /mpass:CurrentPassword123 /setmpass:NewPassword456 | NetopPwdUtil.exe

Replace the example passwords with values managed by your organization. Do not reuse the sample values shown above. Safer automation should pipe the request from a protected secret source or variable rather than embedding password literals in shell history.

IMPORTANT! If automation writes the password inline in a shell command, the shell/SSH tooling may still record that command text. Safer automation should pipe from a secret source or variable rather than embedding the password literal in command history.

Result contract

NetopPwdUtil prints exactly one fixed, non-secret status to stdout and exits with the matching code.

Example (Run as administrator):

'/mpass:OldPass123 /setmpass:NewPass123' | .\NetopPwdUtil.exe; $LASTEXITCODE

Example output:

0

Equivalent cmd.exe form (Run as administrator):

echo /mpass:"321" /setmpass:"123" | NetopPwdUtil.exe & echo %ERRORLEVEL%

Example output:

0

Envisioned usage

PowerShell (Run as administrator):

'/mpass:OldPass123 /setmpass:NewPass123' | .\NetopPwdUtil.exe

$LASTEXITCODE

CMD (Run as administrator):

echo /mpass:OldPass123 /setmpass:NewPass123 | NetopPwdUtil.exe

echo %ERRORLEVEL%

Operational guidance

Security guidance

Follow your organization credential-handling policy when invoking the command from automation. Prefer piping from a secure secret source or variable instead of embedding passwords directly in command text.

• Restrict access to scripts or jobs that contain or retrieve maintenance passwords.
• Use a secure credential store for both current and new password values.
• Avoid writing passwords to shell history, SSH command text, logs, console history, monitoring output, or ticketing systems.
• Limit execution permissions to authorized administrators or automation identities.
• Rotate passwords according to your organization security policy.
• Confirm that automation captures only the non-secret status and exit code, not password values, password length, structure, or derivatives.

Logging and audit

Maintenance password rotation activity is recorded for audit and troubleshooting where Host logging is available. Log entries must not contain password values, password length, structure, or derivatives. Administrators can use the returned non-secret status, exit code, and available Host logs together to confirm whether a rotation attempt succeeded or failed.

Troubleshooting

June 2026 | Version 1.0