Changing the default password of Sitecore Commerce (XC) is not as simple as in Sitecore.

When we install Sitecore Commerce 9.0 onwards, it creates 8 web applications in your IIS. You can find default password at multiple places in the commerce application’s configuration files. So we have to update the new password all the places.

One thing remembers multiple unsuccess log-in will lock user. So it’s better to stop the application pool of the other web applications installed with Sitecore Commerce.

Step-1: Stop application pool of the web applications installed with Sitecore commerce except (cm website).

Step-2: Follow the steps mentioned here, to change the password of Sitecore.

Step-3: Change the password mentioned in the Sitecore Commerce configuration files mentioned below:

1. C:\inetpub\wwwroot\CommerceAuthoring_Sc9\wwwroot\bootstrap\Global.json
2. C:\inetpub\wwwroot\CommerceAuthoring_Sc9\wwwroot\data\Environments\PlugIn.Content.PolicySet-1.0.0.json
3. C:\inetpub\wwwroot\CommerceMinions_Sc9\wwwroot\bootstrap\Global.json
4. C:\inetpub\wwwroot\CommerceMinions_Sc9\wwwroot\data\Environments\PlugIn.Content.PolicySet-1.0.0.json
5. C:\inetpub\wwwroot\CommerceOps_Sc9\wwwroot\bootstrap\Global.json
6. C:\inetpub\wwwroot\CommerceOps_Sc9\wwwroot\data\Environments\PlugIn.Content.PolicySet-1.0.0.json
7. C:\inetpub\wwwroot\CommerceShops_Sc9\wwwroot\bootstrap\Global.json
8. C:\inetpub\wwwroot\CommerceShops_Sc9\wwwroot\data\Environments\PlugIn.Content.PolicySet-1.0.0.json

Assuming your Sitecore Commerce websites are installed on default location.

That's All !!!

Rest your IIS and open your websites. You default password (admin/b) will no longer valid.

Just in case, if you are trying to log-in into CMS using new credentials and it is not allowing to log-in. It means your account got a lock.

You can unlock your account using below SQL query:

UPDATE aspnet_Membership SET IsLockedOut = 0 WHERE UserId = (SELECT UserId FROM aspnet_Users WHERE UserName = 'sitecore\Admin')