FNDCPASS – Change SYSADMIN and APPS Passwords in Oracle E-Business Suite (Complete Oracle Apps DBA Guide)

📅 Last Updated: August 2026

This guide has been completely updated for Oracle E-Business Suite R12.1 and R12.2 running on Oracle Database 11g, 12c, 19c, 21c, and Oracle Database 23ai. It covers the legacy FNDCPASS utility, Oracle's recommended AFPASSWD utility, APPS/APPLSYS password synchronization, SYSADMIN password management, AutoConfig, WebLogic considerations, security best practices, and production troubleshooting.

Managing passwords securely is one of the most important responsibilities of an Oracle E-Business Suite (EBS) Applications DBA. Password changes are required during system hardening, security audits, user administration, cloning activities, password expiration, and compliance with organizational security policies.

Oracle E-Business Suite provides the FNDCPASS utility for changing passwords of application users, the APPS/APPLSYS accounts, and product schema accounts. Although Oracle now recommends using AFPASSWD for most password management tasks in newer releases, FNDCPASS remains supported and is still widely used in many production environments for backward compatibility and specific administrative operations.

This guide explains how FNDCPASS works, when it should be used, how it compares with AFPASSWD, and how to safely change passwords in Oracle E-Business Suite production environments.

Quick Solution

Use AFPASSWD whenever possible because Oracle recommends it for modern EBS environments. If your organization uses FNDCPASS, execute the appropriate password change command, synchronize APPS/APPLSYS credentials where required, run AutoConfig after changing system schema passwords, update WebLogic data sources in Oracle EBS R12.2 when applicable, and restart application tier services before validating user logins.

What is FNDCPASS?

FNDCPASS is a command-line utility supplied with Oracle E-Business Suite that changes passwords for application users and database schema accounts while maintaining the required synchronization between Oracle EBS metadata and the database.

Unlike manually changing passwords with SQL statements, FNDCPASS performs the additional Oracle EBS updates required to keep application components functioning correctly.

FNDCPASS vs AFPASSWD

Oracle recommends AFPASSWD for most modern environments because it improves password security by avoiding exposure of passwords on the command line. However, FNDCPASS remains available for compatibility and certain administrative tasks.

Feature	FNDCPASS	AFPASSWD
Supported	Yes	Yes
Oracle Recommended	No (Legacy)	Yes
Password Visible on Command Line	Yes	No
Interactive Password Prompt	No	Yes
Recommended for New Environments	No	Yes

Oracle EBS Password Architecture

Oracle E-Business Suite maintains several different types of passwords, each serving a specific purpose within the application architecture.

Oracle EBS

      │

      ├────────────► SYSADMIN User

      │

      ├────────────► APPS

      │

      ├────────────► APPLSYS

      │

      ├────────────► Product Schemas

      │

      └────────────► Database Users

Each password type has its own administration procedure and operational impact.

Understanding the Major Accounts

Account	Purpose
SYSADMIN	Oracle EBS application administrator account.
APPS	Main Oracle EBS application schema used by application services.
APPLSYS	Owns many Oracle Applications objects and administrative metadata.
Product Schemas	Own application-specific database objects.
Database Users	Standard Oracle database accounts.

Common Reasons for Changing Passwords

Security policy compliance.
Password expiration.
Annual or quarterly password rotation.
Oracle EBS cloning.
Production migration.
Security incident response.
Administrative user changes.
Audit recommendations.
Application hardening.
Regulatory compliance.

Business Impact

Incorrect password management can affect the availability of Oracle E-Business Suite and lead to authentication failures across multiple application components.

Potential impacts include:

Users unable to log in.
Concurrent Manager failures.
Workflow mailer interruptions.
WebLogic datasource authentication failures.
Application tier startup failures.
Downtime during production maintenance.

Before You Begin

Before changing any Oracle EBS password, verify the following:

Take a backup of the database.
Back up the application tier context files.
Confirm the current APPS password.
Identify the Oracle EBS release (R12.1 or R12.2).
Ensure you have appropriate administrative privileges.
Schedule a maintenance window for production systems.
Notify affected users if service interruption is expected.

Prerequisites

Application tier environment sourced.
Oracle database available.
Application services healthy.
Administrative shell access.
Knowledge of existing credentials.
AutoConfig available.

Production Oracle Apps DBA Recommendation

Avoid manually changing Oracle EBS application schema passwords using SQL ALTER USER statements alone. Always use the appropriate Oracle utility—preferably AFPASSWD for supported environments, or FNDCPASS where required—to ensure application metadata remains synchronized. After changing APPLSYS/APPS passwords, complete all required post-change tasks, including AutoConfig and any release-specific application tier updates.

Changing the SYSADMIN Password

The SYSADMIN account is the default Oracle E-Business Suite application administrator. Password changes for this account do not modify any database schema passwords—they only update the Oracle Applications administrator account.

Example:

FNDCPASS apps/<APPS_PASSWORD> 0 Y SYSTEM/<SYSTEM_PASSWORD> \
SYSTEM SYSADMIN <NEW_PASSWORD>

After the command completes successfully, verify that the SYSADMIN user can log in to Oracle E-Business Suite.

Changing the APPS and APPLSYS Passwords

The APPS and APPLSYS schemas are tightly synchronized. Oracle E-Business Suite requires these passwords to remain identical.

Example:

FNDCPASS apps/<OLD_APPS_PASSWORD> 0 Y SYSTEM/<SYSTEM_PASSWORD> \
SYSTEM APPLSYS <NEW_PASSWORD>

This command updates both the APPS and APPLSYS passwords together.

Important

Do not attempt to change the APPS or APPLSYS passwords independently using ALTER USER. Doing so can leave Oracle E-Business Suite in an inconsistent state and prevent application services from connecting successfully.

Changing Product Schema Passwords

FNDCPASS can also update Oracle EBS product schema passwords while maintaining the required application metadata.

General syntax:

FNDCPASS apps/<APPS_PASSWORD> 0 Y SYSTEM/<SYSTEM_PASSWORD> \
ORACLE <SCHEMA_NAME> <NEW_PASSWORD>

Examples of product schemas include application-specific schemas used by Oracle EBS modules.

Changing Other Oracle Application Users

Oracle EBS application user passwords can also be changed with FNDCPASS.

General syntax:

FNDCPASS apps/<APPS_PASSWORD> 0 Y SYSTEM/<SYSTEM_PASSWORD> \
USER <USERNAME> <NEW_PASSWORD>

For most routine application user password resets, administrators typically use the Oracle EBS administration interface rather than the command line.

Run AutoConfig After Changing APPS/APPLSYS

After changing the APPS/APPLSYS password, run AutoConfig to update Oracle E-Business Suite configuration files with the new credentials.

Execute AutoConfig on:

Application tier
Database tier

Typical command:

adautocfg.sh

Review the AutoConfig log and ensure it completes without errors.

Oracle EBS R12.2 – Update WebLogic Data Sources

For Oracle E-Business Suite R12.2 environments, changing the APPS/APPLSYS password also requires updating the WebLogic data source credentials so managed servers can continue connecting to the database.

After updating the data source configuration, restart the affected WebLogic services.

Restart Oracle EBS Services

Once all password updates and configuration changes are complete, restart the Oracle E-Business Suite services.

adstpall.sh

adstrtal.sh

For R12.2, ensure that all required WebLogic managed servers also restart successfully.

Verify the Password Change

After the services have restarted:

Log in using the updated SYSADMIN password.
Verify application functionality.
Check Concurrent Manager status.
Review Workflow Mailer status if configured.
Confirm managed servers connect successfully.
Review application logs for authentication errors.

Production Troubleshooting

If problems occur after changing passwords, verify the following:

APPS/APPLSYS passwords are synchronized.
AutoConfig completed successfully.
WebLogic data sources were updated (R12.2).
Application services restarted correctly.
No authentication errors appear in the logs.
The correct password was entered during the FNDCPASS operation.

Production Case Study

Following a scheduled password rotation, an Oracle E-Business Suite R12.2 environment failed to allow user logins even though the APPS/APPLSYS password change completed successfully.

Investigation revealed that AutoConfig had not been executed after running FNDCPASS, and the WebLogic data source was still using the previous database password. After updating the data source configuration, running AutoConfig on both tiers, and restarting all application services, normal system operation was restored.

Oracle Apps DBA Checklist

Verification	Status
Password Backup Completed	☐
Database Backup Available	☐
FNDCPASS/AFPASSWD Executed Successfully	☐
APPS/APPLSYS Passwords Synchronized	☐
AutoConfig Completed	☐
WebLogic Data Sources Updated (R12.2)	☐
Application Services Restarted	☐
SYSADMIN Login Verified	☐
Concurrent Manager Verified	☐
Application Logs Reviewed	☐

Oracle E-Business Suite Password Management Best Practices

Password management is a critical part of Oracle E-Business Suite security. Following Oracle-recommended procedures helps protect application accounts while minimizing the risk of authentication failures and production downtime.

Use AFPASSWD instead of FNDCPASS whenever supported by your Oracle EBS release.
Schedule password changes during approved maintenance windows.
Back up the database and application tier context files before changing critical passwords.
Run AutoConfig after changing APPS/APPLSYS passwords.
Update WebLogic data sources in Oracle EBS R12.2 after APPS/APPLSYS password changes.
Restart all required application tier services.
Verify application functionality before returning the environment to users.
Maintain strong passwords that comply with your organization's security policy.
Document all password changes through your change management process.
Restrict knowledge of privileged passwords to authorized administrators.

Common Oracle Apps DBA Mistakes

Using ALTER USER directly to change APPS or APPLSYS passwords.
Changing APPS and APPLSYS passwords independently.
Skipping AutoConfig after password changes.
Forgetting to update WebLogic data sources in R12.2.
Not restarting application services after password updates.
Ignoring authentication errors in application logs.
Executing password changes outside an approved maintenance window.
Failing to verify SYSADMIN login after changing credentials.
Not backing up configuration files before making changes.
Exposing passwords in command history or scripts.

Useful Oracle Apps DBA Commands

Run AutoConfig

adautocfg.sh

Stop Oracle EBS Services

adstpall.sh

Start Oracle EBS Services

adstrtal.sh

Source the Application Environment

. APPS<SID>_<HOSTNAME>.env

Verify Database Connectivity

sqlplus apps/<APPS_PASSWORD>

Review AutoConfig Log Files

tail -100 $APPL_TOP/admin/<CONTEXT_NAME>/log/*.log

Troubleshooting Flowchart

Need Password Change

        │

        ▼

Use AFPASSWD?

        │
        ├────────────► Yes
        │                 │
        │                 ▼
        │       Run AFPASSWD
        │
        ▼

Use FNDCPASS

        │

        ▼

Password Changed?

        │
        ├────────────► No
        │                 │
        │                 ▼
        │      Review Command Output
        │
        ▼

Run AutoConfig

        │

        ▼

Update WebLogic
(R12.2)

        │

        ▼

Restart Services

        │

        ▼

Verify Login

        │

        ▼

Production Ready

Frequently Asked Questions (FAQ)

Is FNDCPASS still supported?

Yes. Oracle continues to support FNDCPASS for compatibility, but recommends using AFPASSWD for most password management tasks because it avoids exposing passwords on the command line.

Can I change the APPS password using SQL?

No. Do not use ALTER USER to change the APPS or APPLSYS passwords directly. Always use the appropriate Oracle EBS password management utility to keep application metadata synchronized.

Do I need to run AutoConfig after changing APPS/APPLSYS?

Yes. Running AutoConfig updates Oracle EBS configuration files with the new credentials and is an essential post-change step.

What additional steps are required in Oracle EBS R12.2?

After changing the APPS/APPLSYS password, update the WebLogic data source credentials, then restart the required managed servers and verify successful database connectivity.

Should users be logged out before changing passwords?

For production systems, perform password changes during a planned maintenance window and ensure users are informed of any expected service interruption.

About the Author

Rana Abdul Wahid is an Oracle Database and Oracle E-Business Suite Consultant with more than 15 years of experience in Oracle Database Administration, Oracle E-Business Suite Application DBA, Oracle Cloud Infrastructure (OCI), Oracle RAC, Oracle Data Guard, RMAN Backup & Recovery, Linux/Unix Administration, MySQL, Microsoft SQL Server, PostgreSQL, and enterprise infrastructure management.

He has extensive experience in Oracle EBS administration, including password management, cloning, AutoConfig, patching, WebLogic administration, Concurrent Processing, Workflow, Forms, Reports, and enterprise production support. His articles are based on practical implementation experience and are intended to provide reliable, production-tested solutions for Oracle Apps DBAs.

Learn more about the author →

Conclusion

Changing passwords in Oracle E-Business Suite involves more than simply updating database credentials. Using the correct Oracle utility, synchronizing application metadata, running AutoConfig, updating WebLogic data sources where applicable, and validating application functionality are all essential steps in maintaining a secure and stable Oracle EBS environment.

By following Oracle-recommended procedures and implementing structured password management practices, Oracle Apps DBAs can reduce operational risk, improve security, and ensure uninterrupted access to critical business applications.

Final Oracle Apps DBA Recommendation

Treat password management as a controlled administrative process rather than a simple command execution. Always verify prerequisites, use the appropriate Oracle utility, complete all required post-change tasks, review application logs, and validate the entire Oracle E-Business Suite environment before concluding the maintenance activity.

Found this guide helpful? Visit the Oracle Error Codes Guide for more production-tested Oracle Database, Oracle E-Business Suite, Linux, and enterprise administration tutorials.

Oracle Database Error Solutions & DBA Knowledge Base