Reset the Root Password on RHEL 10

You locked yourself out of root on a RHEL 10 host and need the installed system's account database updated—not a throwaway initramfs shell that disappears on reboot. The workflow tested here on RHEL 10.2 uses the same dracut rd.break recovery sequence documented by Red Hat for recent RHEL releases: a one-time GRUB edit that adds rd.break, stops boot inside dracut, remounts your real root at /sysroot, and runs passwd against /etc/shadow on the disk you boot from every day.

Before You Reset the Root Password

Recovery assumes you can touch the boot path before systemd takes over the installed system. Gather these pieces before you reboot.

This procedure changes only the local root password stored in /etc/shadow on that machine. It does not reset LDAP, Active Directory, or IdM passwords, and it does not grant remote access by itself.

On the lab host used for command captures below, SELinux is enforcing and the default kernel carries the usual quiet boot parameters:

grubby --default-kernel

Sample output:

/boot/vmlinuz-6.12.0-211.42.1.el10_2.x86_64

The matching kernel arguments include LVM root and swap paths plus rhgb quiet:

grubby --info=/boot/vmlinuz-6.12.0-211.42.1.el10_2.x86_64 | grep ^args=

Sample output:

args="ro resume=UUID=78531da6-a389-46e8-9bad-267572940826 rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet"

Those strings are what you edit at the GRUB screen—append rd.break, and optionally remove rhgb quiet so boot messages stay visible while you troubleshoot.

Root Password Recovery Quick Reference

Use this map as a checklist while you work. Each step below in Method 1 explains the system state and why the command exists.

Do not treat the table as a silent command dump. If any row fails, use the troubleshooting section before you randomize more kernel parameters.

Reset Root Password from the GRUB Boot Entry

Method 1 is the primary workflow on the tested RHEL 10.2 host: rd.break with dracut, matching the /sysroot → chroot → passwd → /.autorelabel → remount read-only → exit sequence Red Hat documents for RHEL 8 and 9. You never permanently edit /boot/grub2/grub.cfg for a one-off password reset.

Interrupt the GRUB menu

Reboot the host from console or your hypervisor power menu—not ssh root@host reboot alone, because you need the graphical or serial console to see GRUB.

On this lab system GRUB hides the menu after a short timeout:

grub2-editenv list

Sample output:

saved_entry=23b7a5ba4a464d768c37c2b2990e7d06-6.12.0-211.42.1.el10_2.x86_64
menu_auto_hide=1
boot_success=0
boot_indeterminate=0

When menu_auto_hide=1, repeatedly press Esc or F8, or hold Shift during early boot. Hypervisors vary in how they deliver these keys, so use the VM console rather than SSH. Once the menu appears, highlight a kernel entry and press e to edit.

If GRUB prompts for a username and password before editing, the bootloader is protected with grub2-setpassword. Recovery without that password is outside this article.

Edit the kernel entry

Highlight the kernel you normally boot—usually the newest non-debug entry, not the +debug variant unless you intentionally run debug kernels.

Press e to open the editor. Move to the line that starts with linux or linuxefi. That line carries kernel options dracut and systemd will consume.

Typical RHEL 10 content before your edit looks like the grubby output above: ro, resume=, rd.lvm.lv= paths, then rhgb quiet.

Make two deliberate changes on that single line:

• Remove rhgb quiet if you want Plymouth and quiet boot to stop hiding messages. This is optional but helps when the screen stays blank.
• Append rd.break at the end of the line so dracut stops in initramfs before switching root into the installed system.

Example shape after edit (your UUIDs and paths will differ):

linux /vmlinuz-6.12.0-211.42.1.el10_2.x86_64 ro resume=UUID=78531da6-a389-46e8-9bad-267572940826 rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rd.break

Do not remove rd.lvm.lv= entries when root lives on LVM. Do not add unrelated tuning parameters; rd.break is the switch that creates the recovery stop point.

Press Ctrl+x to boot with this modified line once. The permanent entry on disk stays unchanged.

Enter the rd.break recovery environment

After firmware and dracut start, the boot pauses before the installed root becomes your working environment. The prompt looks like:

switch_root:/#

You are in the initramfs emergency shell. The installed RHEL system is mounted beneath /sysroot, usually read-only. Paths like /etc/shadow inside /sysroot are the real files; running passwd now without chroot would not update the account database you need.

On a normal running system /sysroot does not exist—that path is specific to this early boot stage:

ls /sysroot 2>&1 | head -1

Sample output on a booted host (expected failure):

ls: cannot access '/sysroot': No such file or directory

That error is normal on a healthy running system and confirms you are not already in rd.break.

Remount the installed root read-write

dracut attaches the real root filesystem at /sysroot read-only until you remount it:

mount -o remount,rw /sysroot

mount prints nothing when the remount succeeds. Without read-write mode, passwd cannot update /sysroot/etc/shadow.

If remount fails with a read-only or busy error, see the troubleshooting table before forcing options.

Change root into the installed system

chroot makes the installed tree your logical root so passwd writes to the correct /etc/shadow:

chroot /sysroot

The prompt changes to something like sh-5.2# because you are now inside the installed system's userland. which passwd should resolve to /usr/bin/passwd from the installed image, not a minimal initramfs copy.

Set the new root password

Run passwd against the root account in the chroot:

passwd root

The command interactively asks for a new password twice. Policy failures—password too short, too simple, or failing pwquality rules—appear immediately in the same shell. Fix the password choice; do not reboot until passwd reports success.

passwd does not echo the characters you type. When it finishes cleanly you should see a line similar to:

passwd: all authentication tokens updated successfully.

Handle SELinux relabeling

On enforcing systems, changing /etc/shadow from a chroot can leave SELinux contexts inconsistent with policy. Logging in as root may still fail until labels are rebuilt.

Check enforcing mode on a booted reference host:

getenforce

Sample output:

Enforcing

When SELinux is Enforcing, schedule a relabel before you leave the chroot:

touch /.autorelabel

touch creates the flag file at the root of the installed filesystem (inside the chroot, path /.autorelabel). On the next boot, policy relabels filesystems before normal login is allowed.

Confirm the marker exists before you leave the chroot:

test -f /.autorelabel && echo autorelabel-present || echo autorelabel-missing

Sample output:

autorelabel-present

That output confirms the relabel marker is on the installed root—the critical SELinux recovery step is in place before you exit.

Relabel duration scales with disk size. Large servers may appear hung while relabel runs; wait until the host reboots into a normal login prompt.

Exit and reboot

Still inside the chroot, remount the installed root read-only before you leave—Red Hat's documented sequence ends with this step:

mount -o remount,ro /

Remounting read-only matches Red Hat's recovery sequence and lets the initramfs handoff continue from a clean filesystem state. mount exits silently when the remount succeeds.

Leave the chroot so you return to the initramfs shell:

exit

You should be back at switch_root:/#. Exit again so dracut continues boot:

exit

The kernel proceeds with startup. If /.autorelabel exists, expect a relabel phase before multi-user login.

Verify root access

After the host finishes booting, use the console first—keyboard on the machine or hypervisor—not SSH.

Log in as root with the password you set in the chroot. Then confirm identity:

id

Sample output:

uid=0(root) gid=0(root) groups=0(root)

Confirm SELinux returned to enforcing after relabel:

getenforce

Sample output:

Enforcing

Optional detail from sestatus:

sestatus | head -4

Sample output:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted

If id shows root but login still fails, check whether the account is locked or SSH policy blocks root—see the sections below rather than repeating GRUB edits.

About the 0-rescue-* GRUB entry

RHEL also lists a 0-rescue-* boot entry in GRUB—the lab host shows one with a dedicated rescue initramfs. That entry is a fallback kernel and broader rescue initramfs, not an interactive password-reset environment like Anaconda's rescue mode. The rescue initramfs is deliberately broader than a normal host-only image, but it can still boot the installed OS normally.

Selecting 0-rescue-* alone does not drop you into a maintenance shell or run mount → chroot → passwd for you. If your normal kernel or initramfs cannot boot far enough for rd.break, the rescue entry may provide another bootable kernel—but you still edit that entry and append rd.break when you want this password-reset workflow.

RHEL 10's installer rescue environment is separate: boot installation media, choose Troubleshooting → Rescue a Red Hat Enterprise Linux system, or use inst.rescue. That path is outside this guide.

For one-boot target overrides when the system reaches GRUB but you want rescue.target semantics on a normal boot, append systemd.unit=rescue.target to the kernel line. See systemd targets and rescue mode for how rescue differs from emergency mode on a running system—not for GRUB rd.break password recovery.

Reset a user password when root or sudo still works

Some visitors land on this page when they still have administrative access. Boot recovery is unnecessary if you can run passwd from the installed system.

Reset root while logged in as a sudo-capable user:

sudo passwd root

Reset another local user:

sudo passwd username

sudo updates the same /etc/shadow database but from the normal running system. SELinux contexts usually stay consistent because you are not in an rd.break chroot. You still need a password that satisfies local policy.

Root account locked vs password forgotten

Symptoms overlap but fixes differ. Password hash locking, PAM faillock lockout, and a disabled login shell are separate mechanisms—check the right signal before you reboot into GRUB.

Password locking invalidates the password hash in /etc/shadow. PAM faillock tracks failed authentication attempts. Those are independent—usermod -L locks the password hash; it does not change the login shell in /etc/passwd.

Inspect password hash status on a host where you still have access:

passwd -S root

Sample output:

root P 2026-08-03 0 99999 7 -1

The second column is password status: P means a password is set, L or LK means the hash is locked. Unlock with passwd -u root or usermod -U root from a sudo session—not by editing shadow by hand.

When login fails after several wrong attempts, check faillock separately:

faillock --user root

If the table lists recent failures, reset the counter with faillock --user root --reset before you assume the password itself is wrong.

Troubleshoot root password recovery

What not to do

Keep recovery narrow. These shortcuts create worse outages:

• Do not set selinux=0 or permanently disable SELinux to avoid relabel—fix contexts instead.
• Do not delete /etc/shadow or truncate password hashes manually.
• Do not hand-edit /boot/grub2/grub.cfg for a one-time rd.break boot—use the GRUB editor so the change is not persistent.
• Do not confuse GRUB superuser passwords with the Linux root password—they protect different layers.

Related recovery topics

• Configure GRUB2 on RHEL — permanent kernel defaults, grubby, and BLS entries when you need more than a one-boot edit.
• GRUB2 password protection — how superuser accounts block casual e key access.
• SELinux modes and contexts — enforcing vs permissive and when relabel is mandatory.
• systemd targets and rescue — rescue.target and emergency.target when the system boots but you need a maintenance shell.
• grubby command examples — inspect kernel indices and arguments from a running system before you reboot.

References

• Red Hat Enterprise Linux 8 — Resetting the forgotten root password on boot
• Red Hat Enterprise Linux 8 — Resetting the root password using rd.break
• Red Hat Enterprise Linux 10 — Kernel command-line parameters
• dracut.cmdline — rd.break

Summary

Resetting a forgotten root password on RHEL 10 is a bootloader-time procedure, not an SSH session. You interrupt GRUB once, append rd.break to the linux line, and boot into dracut's switch_root shell where the real system waits read-only under /sysroot. Remounting read-write, chroot /sysroot, and passwd root update the installed /etc/shadow—the same database normal boot uses.

SELinux enforcing mode adds a step competitors often skip. Creating /.autorelabel before reboot schedules a full relabel so /etc/shadow and related paths regain correct contexts. That pass can take a long time on large disks; powering off mid-relabel leaves the system in a worse state than waiting.

After boot, verify at the console with id and getenforce before you chase SSH or PAM issues. If sudo or another admin account still works, sudo passwd root avoids the recovery boot entirely. When GRUB itself is password-protected or disks stay encrypted, fix those layers first—this guide assumes you can edit one kernel entry and reach the installed root filesystem.

For permanent GRUB changes, rescue target behavior, or SELinux policy depth, use the recovery-topic links above rather than expanding this page into a general bootloader course.