Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The safest recovery order is: use another local account that still has sudo, then use the distribution’s built-in recovery mode, and only then boot trusted live or installation media. These methods can grant unrestricted root access, so use them only on a server you own or are authorized to administer.
First identify the distribution and release, confirm whether the machine can reboot to GRUB, and determine whether the root filesystem is encrypted or currently read-only. Ubuntu, Debian, RHEL 7, and RHEL 9 do not use identical account or boot-recovery procedures.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteChoose the least invasive recovery path
Your options depend on four immediate questions: does another administrator still have working sudo, can you reach the boot loader, do you have trusted recovery media, and can the installed root filesystem be mounted read-write?
| Situation | Preferred method | What it changes | Main limitation |
|---|---|---|---|
| Another local account can run sudo | Log in to that account and run the appropriate sudo passwd command |
Repairs the affected password without rebooting | Requires a functioning sudo policy and an account that can authenticate |
| Ubuntu reaches GRUB and no administrator can log in | Ubuntu recovery mode and a root shell | Repairs a password or account from the installed system | Recovery filesystems may start read-only |
| The installed system cannot provide a usable shell | Trusted live or installation media with chroot |
Mounts the installed system for password and account repair | Requires console access and correct identification of the installed partitions |
| RHEL 9 has no root login and no sudo-capable account | RHEL 9’s documented special boot mode | Resets the root password during the boot process | The GRUB and initramfs procedure is release-specific |
| RHEL 7 has no usable administrator | Installation-disk recovery or the rd.break method |
Stops before normal system control is handed to systemd | Mount behavior and follow-up commands differ from newer releases |
| Debian’s root account is disabled | Recover the first user’s password or sudo authorization | Restores the account that normally performs administration | Resetting a root password may not be the right fix |
Prepare before changing credentials
- Confirm that you own the server or have explicit authorization to perform boot-loader or live-media recovery.
- Record the distribution and release. Do not apply a RHEL 7 procedure to RHEL 9, or assume Ubuntu and Debian have the same root-account behavior.
- If the machine is unstable but its storage is readable, copy critical data while you still can. Rescue environments can provide file access even when a normal boot fails.
- Make sure you have console access, a trusted recovery image, or the provider’s documented rescue channel before rebooting a remote server.
- Expect a recovery shell to have full root authority. A typo in a password, mount point, or sudo policy can make the system harder to boot.
Use a second sudo-capable account first
This is the shortest and least disruptive route because it leaves the boot process and filesystem layout alone. Log in locally or through your normal administrative console with the account that still works, then confirm that sudo is actually available.
#1 Best Overall
- Portable Kali Linux: Carry the power of Kali Linux on a bootable USB drive for seamless cybersecurity.
- Live Environment: Pre-configured to boot directly into a 'Live' Kali Linux environment without installation, enabling instant access.
- Versatile Compatibility: Designed to work with most modern computers and laptops, providing a flexible platform for various tasks.
- Secure and Encrypted: Kali Linux offers robust security features, encryption tools, and a vast array of penetration testing utilities.
- Current Version: Kali 2026.2 uses kernel 6.19 and includes GNOME 50 and KDE Plasma 6.6 updates. We will update with newer stable versions of Kali as they are released.
- Check the account and its groups with
idand verify sudo authentication withsudo -v. - Reset the affected account by running
sudo passwd USER, replacingUSERwith the real login name. Enter the new password twice when prompted. - If the lost credential is the root password on RHEL 9, a non-root user in the
wheelgroup can runsudo passwd root. - Test the repaired account in a separate session before closing the working administrator session. A fresh login confirms that the password, shell, and account name are correct.
Check sudo authorization after the password reset
A password repair does not restore a removed group membership or a damaged sudo policy. Use id USER to check the account’s groups and review the intended sudo configuration. Validate syntax with visudo -c rather than editing /etc/sudoers directly. If the account was removed from the distribution’s administrator group, restore the correct group membership using the distribution’s normal administration tools, then open a new login session so group changes are applied.
Recover Ubuntu through GRUB recovery mode
Ubuntu documents recovery mode for the case in which neither the root account nor another local administrator can log in. You need a console or keyboard-accessible display and the ability to reboot the machine.
- Reboot the server. On systems that use the traditional BIOS-style GRUB screen, hold the right Shift key while the machine starts. Hardware vendors and virtual-machine consoles may use a different documented key or menu to expose GRUB.
- At the GRUB menu, choose Advanced options for Ubuntu.
- Select the appropriate installed kernel entry whose label ends in recovery mode. If several kernels are listed, choose the one that normally boots the server unless you are deliberately recovering from a kernel-specific problem.
- In the recovery menu, choose drop to root shell prompt.
- Check whether the installed root filesystem is writable. Recovery environments commonly mount it read-only to prevent accidental changes.
- If it is read-only, remount it with
mount -rw -o remount /. - Reset the affected account with
passwd USER. Set a root password only when that is part of your intended account design; Ubuntu systems often rely on a named administrator and sudo instead. - Exit the shell and choose the recovery menu’s reboot option, or run
rebootafter leaving the shell. Remove any temporary boot selection and verify a normal boot.
When the password command fails
An error about an authentication token, a read-only filesystem, or an inability to update password files usually means the installed root filesystem is still mounted read-only or the shell is not operating inside the installed system. Return to the recovery menu, remount the root filesystem read-write, and run the command again. Do not repeatedly overwrite account files while the filesystem is in an uncertain state.
Repair the installed system from trusted live or installation media
Use this fallback when the installed system cannot reach a useful recovery shell. Ubuntu’s LiveCdRecovery procedure mounts the installed partition under /mnt, enters it with chroot, and runs the password or account-repair command against the installed files.
Rank #2
- LINUX MINT 22.3 MEDIA - 16GB bootable USB with Linux Mint Cinnamon 22.3 for compatible x86-64 PCs.
- LIVE OR INSTALL - On supported hardware, start the Linux Mint live environment to evaluate it or launch the installer.
- PLATFORM BOUNDARY - Not designed to boot Apple Silicon or other ARM-based computers. Confirm CPU architecture and USB-boot support before purchase.
- BOOT SETTINGS VARY - Boot-menu keys and UEFI settings differ by manufacturer; consult the computer maker's instructions if the USB is not listed.
- BACK UP BEFORE INSTALLING - Disk-partition and installation choices can erase files or operating systems. Disconnect nonessential drives and preserve the USB until it is no longer needed for installation or recovery.
- Obtain trusted live or installation media appropriate for the server’s architecture and boot it from the machine’s console. A writable USB flash drive is the usual physical medium for creating a Linux live USB flash drive.
- Open a terminal in the live environment and identify the installed Linux partitions. Device names vary by machine; do not copy a sample such as
/dev/sda1without checking the actual layout. - Mount the installed root partition at
/mnt, for example withmount /dev/DEVICE /mnt, replacingDEVICEwith the partition you identified. - If the installation uses separate filesystems such as
/bootor/home, mount them at their corresponding directories below/mntbefore changing files that depend on them. - Enter the installed environment with
chroot /mnt. Commands now operate on the installed system’s account database rather than the live session’s temporary accounts. - Run
passwd USERfor the affected user. If you are repairing sudo rather than a password, inspect the installed account’s groups and sudo configuration while inside the chroot. - Leave the chroot with
exit, unmount the installed filesystems cleanly, remove the media, and reboot from the internal disk. - Log in through a normal boot and perform the verification checks below before declaring the recovery complete.
Adapt the mount plan to the actual storage layout
The live-media method is not a recipe for one fixed device name or mount point. Encrypted volumes must be unlocked before their filesystems can be mounted, and a server with separate logical volumes may require several mounts. If you cannot identify the root volume confidently, stop rather than mounting a guessed partition over /mnt; a wrong mount can lead you to edit the live environment or the wrong installation.
RHEL 9: use the documented special boot mode
RHEL 9 provides a documented recovery procedure for the situation in which root login is unavailable and no non-root account can run sudo. This is a boot-time operation, so use a local console or a remote console that exposes the boot loader.
- Reboot and interrupt GRUB when its menu appears.
- Press
eto edit the selected boot entry temporarily. - Modify the kernel command line as described in the RHEL 9 password-recovery procedure to enter the special mode. The exact line and placement matter; do not leave the edit in persistent boot configuration.
- Boot the edited entry. The procedure performs the password reset in the early boot environment before control is handed from initramfs to the installed system.
- Complete the documented handoff and set the new root password when prompted by the procedure.
- Reboot normally, then test root or a newly repaired administrator account from a fresh session.
RHEL 9’s path is intentionally different from older single-user instructions. If your server is actually RHEL 7 or another release, use that release’s recovery documentation instead of improvising with the RHEL 9 sequence.
RHEL 7: installation media or rd.break
RHEL 7 documents two recovery approaches: boot from an installation disk, or add rd.break to stop the boot process before initramfs hands control to systemd. The resulting mount points and commands are not interchangeable with every older GRUB release.
Rank #3
- 1. 9-in-1 Linux:32GB Bootable Linux USB Flash Drive for Ubuntu 24.04 LTS, Linux Mint cinnamon 22, MX Linux xfce 23, Elementary OS 8.0, Linux Lite xfce 7.0, Manjaro kde 24(Replaced by Fedora Workstation 43), Peppermint Debian 32bit (being replaced by MX Linux 32bit) for older PC, Pop OS 22, Zorin OS core xfce 17. The versions you received might be latest than above as we update them to latest/LTS when we think necessary.
- 2. Try or install:Before installing on your PC, you can try them one by one without touching your hard disks.
- 3. Easy to use: These distros are easy to use and built with beginners in mind. Most of them Come with a wide range of pre-bundled software that includes office productivity suite, Web browser, instant messaging, image editing, multimedia, and email. Ensure transition to Linux World without regrets for Windows users.
- 4. Support: Printed user guide on how to boot up and try or install Linux; please contact us for help if you have an issue. Please press "Enter" a couple of times if you see a black screen after selecting a Linux.
- 5. Compatibility: Except for MACs,Chromebooks and ARM-based devices, works with any brand's laptop and desktop PC, legacy BIOS or UEFI booting, Requires enabling USB boot in BIOS/UEFI configuration and disabling Secure Boot is necessary for UEFI boot mode. Packing: The bootable USB drive comes in a colored PET/CPP zipper bag with instructions on how to get started. The box pictured is not included.
Installation-disk approach
Boot the matching RHEL installation media, choose its rescue function, and let the environment locate the installed system. Once the installed root is available, follow the rescue environment’s instructions to enter it and run passwd for the account that needs repair. Confirm which filesystem is mounted as the installed root before changing files. Exit the rescue environment, remove the media, and test a normal boot.
rd.break approach
- At the GRUB menu, highlight the normal RHEL 7 entry and press
e. - Append
rd.breakto the kernel command line, then boot the temporary edit. - The system stops before normal systemd control is transferred. Follow the RHEL 7 procedure for making the installed root available, changing the password, and completing the boot handoff.
- Reboot without the temporary kernel edit and verify the repaired account in the fully booted system.
RHEL 7 recovery instructions warn that rescue and single-user behavior differs from older GRUB releases. Treat the release number as a hard requirement, not a suggestion.
Older RHEL rescue, single-user, and emergency modes
Older Red Hat documentation distinguishes three recovery environments:
- Rescue mode is useful for accessing files when the installed system cannot fully boot. It is commonly reached from installation media.
- Single-user mode starts a minimal administrative environment in which the
passwdcommand can reset the root password. - Emergency mode is more minimal and mounts the root filesystem read-only, so it is intended for diagnosis and limited repair until you deliberately make the filesystem writable.
The documented RHEL 6 guidance states that a root password can be reset by booting into rescue or single-user mode and using passwd. Do not assume that an emergency shell has the same services, mounts, or write access as single-user mode.
Rank #4
- 3-in-1: 16GB Multiboot USB flash drive for Ubuntu 24.04 LTS 64bit & 22.04 LTS 64bit, Lubuntu 18.04 LTS 32bit. All are LTS versions, namely, Long Terrm Support Version. The versions you received might be latest than above as we update them when we think necessary.
- Compatibility: Compatible with any brand's PC, works with both legacy BIOS and UEFI booting mode, except for Apple computers, Chromebooks and ARM-based devices.
- Popularity：Most popular linux distributions and all come with common software includes office software, web browser, image editing, multimedia, and email except Lubuntu which is desgined to targted for very old PC.
- Support: Print user guide and support available. please contact us for help if you have an issue.
- Live USB or install: You can either try on USB or install on hard drive.
Understand Debian’s root-account model
On Debian, the root account may be disabled by default. The first user created during installation can normally perform administration through sudo, so there may be no usable root password to reset.
If that first user’s password is lost or its sudo authorization was removed, recovering the root password alone may not solve the problem. Use the Ubuntu-style recovery or trusted live-media approach to reset the affected named user and restore its intended administrator authorization. Afterward, open a new login session so the repaired group membership and sudo policy are evaluated.
Verify the repair after a normal reboot
A successful passwd command proves only that a password database entry was changed. Perform these checks after removing temporary boot media and booting the installed system normally:
- Confirm the account exists and has the expected shell with
getent passwd USER. - Check group membership with
id USER. Verify that the account belongs to the distribution’s intended administrator group if it must use sudo. - Validate sudo configuration with
visudo -c. A syntax error can disable administrative access even when the password is correct. - Open a new local or remote login session as the repaired user. Do not rely only on a session that was created before the reset.
- Run a harmless privilege check such as
sudo -v, then confirm that the account can perform the specific administrative task it needs. - Check that the login shell is not set to a noninteractive or disabled shell unless that is intentional.
- Review the boot configuration and ensure that no temporary GRUB kernel-line edit was saved permanently.
Troubleshoot the common failure branches
The filesystem remains read-only
Password changes write to the account database. Recovery and emergency environments may mount the installed root read-only by design. Remount it read-write using the command appropriate to the environment before running passwd. If the remount fails, stop and investigate storage errors instead of forcing repeated writes.
Best Value
- Dual USB-A & USB-C Bootable Drive – works with almost any laptop or desktop (UEFI & Legacy BIOS). Boot Tails directly from the USB for secure, private sessions on any computer.
- Customizable Outside Tails – you may Add / Replace / Upgrade any other compatible bootable ISO app, installer, or utility on the USB without modifying Tails itself. You can also update Tails at any time by adding the latest Tails ISO.
- Designed for Privacy & Anonymity – Tails routes all internet traffic through Tor for maximum online privacy and protection against tracking or surveillance. Leave No Trace – your sessions run entirely from the USB and don’t touch the host system. When you shut down, no activity or data remains on the computer.
- Bypass Censorship & Access the Web Freely – browse and communicate securely from anywhere with built-in encryption and privacy tools. No Installation Required – run Tails LIVE directly from the USB. Perfect for journalists, researchers, or anyone who values freedom and security online.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
You changed the wrong installation
Live media can contain its own /etc/passwd and sudo configuration. If you ran passwd before mounting and entering the installed filesystem, you changed the temporary live session. Exit, identify the real root partition, mount it at /mnt, and use chroot /mnt before retrying.
GRUB never appears
Use the server’s documented console method to expose the boot loader. A virtual-machine console, serial console, firmware setting, or provider interface may require a different key sequence than a physical keyboard. If the boot loader is password-protected, you need the authorized recovery procedure for that environment; do not attempt to bypass controls on a system you do not administer.
Recommended Free Tools
The password works but sudo still fails
Inspect group membership, sudoers syntax, and any account policy that was changed separately from the password. A correct password cannot compensate for a removed administrator group or invalid sudo configuration. Use visudo -c and test from a new login session.
The machine cannot boot after recovery
Return to the recovery environment, copy critical data while the disk is accessible, and review the changes made to account files and sudo policy. Rescue mode is specifically useful for file access when a full boot is impossible. Avoid deleting authentication files or replacing them with files from another distribution.
When local recovery is not the right procedure
Stop and use the provider’s documented rescue process when the root filesystem is encrypted and you cannot unlock it, GRUB is protected, Secure Boot policy blocks the chosen media, or the server is remote-only without a working console. Cloud and hosting providers implement rescue consoles differently; there is no single command sequence that applies to all of them.
If the provider controls the boot process, ask for its supported recovery console or rescue image rather than repeatedly rebooting. Keep the distribution and release information ready, because provider instructions often branch on the installed operating system.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Prevent a repeat lockout
- Maintain a second, tightly controlled local administrator account and test its sudo access before an incident.
- Document the exact distribution, release, storage layout, encryption status, and console path for each server.
- Keep trusted installation or live media available and verify that it can boot the hardware or virtual machine before an emergency.
- Protect GRUB and physical consoles, but record the authorized recovery process so security controls do not become an unplanned single point of failure.
- Store backups that can be accessed from rescue mode and test restoration separately from password recovery.
- After changing authentication policy, log in through a fresh session and verify both the account password and the required sudo command.
In practice, the winning strategy is to preserve any remaining sudo access, use the matching distribution recovery path when boot access exists, and reserve live media for systems that cannot provide a trustworthy installed-system shell.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
