Return
-
Title
Password Manager Service Fails to Start After Service Account Password Reset -
Description
After resetting the password of the service account used by the Password Manager service, the service fails to start. When verbose logging is enabled, the following error is recorded in the service log:
"2026-05-12 09:17:46:409 E [6996:1] QPM.Service.Storages.dll StorageManager.ReInitialize() >> System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.at System.Security.Cryptography.SymmetricPadding.GetPaddingLength(ReadOnlySpan`1 block, PaddingMode paddingMode, Int32 blockSize)at System.Security.Cryptography.UniversalCryptoDecryptor.UncheckedTransformFinalBlock(ReadOnlySpan`1 inputBuffer, Span`1 outputBuffer)at System.Security.Cryptography.UniversalCryptoDecryptor.UncheckedTransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)at System.Security.Cryptography.UniversalCryptoTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)at System.Security.Cryptography.CryptoStream.FlushFinalBlockAsync(Boolean useAsync, CancellationToken cancellationToken)at System.Security.Cryptography.CryptoStream.FlushFinalBlock()at QPM.Service.Storages.XmlStorageProtection.Decrypt(String data)at QPM.Service.Storages.XmlStorage.decryptProtectedChapterXml(XElement xml, XmlStorageProtection protection)at QPM.Service.Storages.XmlStorage.Load(Boolean storageInitialized)at QPM.Service.Storages.SharedStorage.Load(Boolean storageInitialized)at QPM.Service.Storages.StorageManager.ReInitialize(ILocalStorage& localStorage, ISharedStorage& sharedStorage, StorageConfiguration storageConfiguration)" -
Cause
This error indicates that the Password Manager service is unable to decrypt the password stored in the
share.storagefile. The Windows DPAPI-protected credentials were tied to the previous service account password and cannot be decrypted under the new password context. -
Resolution
RESOLUTION 1 - Revert the password change
- Revert the service account password to its previous value.
- Restore the backup copies of the
share.storageandlocal.storagefiles. - Start the Password Manager service and verify it initializes correctly.
RESOLUTION 2 - Reinitialize Password Manager
- Remove the
share.storageandlocal.storagefiles located under the C:\ProgramData\One Identity\Password Manager - Launch
PMAdminand initialize the Password Manager instance. - If a configuration backup is available, import it during initialization to restore your previous settings.
- Start the Password Manager service and verify it initializes correctly.
-
Additional Information
For the correct procedure to change the Password Manager service account, application pool, and override account credentials, please refer to the following KB: https://support.oneidentity.com/kb/4308417 If regular rotation of the service account password is required, consider using a group Managed Service Account (gMSA) for the service. For further details, please refer to the following KB: https://support.oneidentity.com/kb/4226330