Kudos (and any points) for this solution should go to Rafeeq.
Instructions:
1. Login to the SEPM where you need to recover the password.
2. It is not necessary to stop any services, and to be best of my knowledge these procedures do no interrupt communication between the manager and clients.
3. Start -> Run: odbcad32
a. Click the System DSN tab
b. Select the SymantecEndpointSecurityDSN and then click the Configure button
i. Click the Database tab
ii. In the Database File field it should llike this:
C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5
iii. Change the “sem5” at the very end to “SEM”
c. Click OK to exit from the ODBC configuration program
4. Make a backup copy of C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Php\php.ini
5. Right-click on the C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Php\php.ini file and select Properties
a. Uncheck read-only
6. In notepad open C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Php\php.ini
a. Modify the following lines to read:
display_errors = On
display_startup_errors = On
7. Save and close php.ini
8. Make a backup copy of C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\Reporting\Common\connectdb.php
9. Right-click on C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\Reporting\Common\connectdb.php and select Properties
a. Uncheck read-only
10. In notepad open C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\Reporting\Common\connectdb.php
a. Search for the word “catch”. It will be in several places, but only two of those places will look like this:
} catch (Exception $e) {
$dpwd = "";
throw $e;
}
b. In both places where you found the above add one additional line so that it looks like this:
} catch (Exception $e) {
echo "GOT IT - this is your password for database !!! {$dpwd}";
$dpwd = "";
throw $e;
}
11. Save and close connectdb.php
12. In Internet Explorer go to
http://localhost:8014/reporting
Note modify your port number in the URL as appropriate.
a. Login using your SEPM administrator credentials
b. After a few seconds an error message (dump) will be displayed. Look for “GOT IT” and your password will be displayed at the end of that line.
13. The last step is to undo all the changes you made. Be sure to set both files back to read-only. Also change the name of the database used by the ODBC DSN.