You typed your password wrong twice, maybe three times, and now HCL Notes is refusing to let you in. Just a heads up, a locked Notes ID can feel like a tough nut to crack when you don’t know which recovery route your organization uses. Or maybe it’s worse — you came back from vacation, tried to log in, and got hit with “Your password has expired” right as you were about to catch up on two weeks of email. That can send an otherwise routine login task into a completely different direction. Either way, you’re staring at a login box that won’t budge, and you need a way in.
Here’s the good news: getting locked out of HCL Notes is common, and there’s almost always a way back in. More often than not, the answer can boil down to knowing whether your ID is protected by an ID Vault or by recovery information. The bad news is that the fix isn’t one-size-fits-all — what you need to do depends entirely on how your organization set up your Notes ID in the first place. This guide walks through every realistic scenario, in plain language, so you (or whoever’s helping you) can figure out which path applies and follow it without needing a Domino certification first.
First, Figure Out Which Situation You’re In
Before doing anything else, there’s one quick check that tells you which section of this guide you actually need. Without further ado, let’s get started and identify the safety net behind your Notes ID.
- Open HCL Notes.
- Go to File > Security > User Security (on a Mac, it’s Notes > Security > User Security).
- Look at the Security Basics tab for a line that says something like: “This ID file has been backed up into vault [vault name].”
If you see that line, your organization uses something called an ID Vault, and Scenario A below is your fix. If you don’t see it, skip to Scenario B or C, depending on what your admin set up when you were onboarded.
If you can’t even get into Notes to check this (because you’re fully locked out), don’t worry — just contact your Notes administrator or IT helpdesk and ask them to check for you. They can see this from their end in seconds.
Scenario A: Your ID Is in an ID Vault (Most Common Setup)
An ID Vault is basically a secure, server-based safety net for Notes ID files. Think of it as a digital fortress protecting a working copy of your Notes ID. Instead of your ID file only existing on your laptop (where it can get lost, corrupted, or locked forever if you forget your password), a protected copy also lives on the Domino server. If something goes wrong on your end, an administrator — or in some cases, you yourself — can pull a working copy back down and get you logged in again.
If your organization has this set up, you’re in a strong position. ID Vault has become the gold standard for protecting Notes IDs against exactly this kind of lockout. Here’s how the reset actually happens.
Option 1: Self-Service Reset (If Your Company Has It Enabled)
Some organizations set up a simple web-based tool that lets you reset your own Notes password without waiting on IT. When it is available, getting back in can be a breeze. If this is available to you, your helpdesk or IT team will have given you a link or instructions for it — it usually just asks you to verify your identity and then lets you set a new password on the spot.
Not every company enables this, so if you’ve never heard of it, you probably don’t have it, and that’s fine — Option 2 is just as effective.
Option 2: Admin-Assisted Reset
This is the most common path, and it’s quick for whoever’s helping you. If you’re the one troubleshooting this for a coworker or end user, here’s the exact process. Pro tip: confirm that the administrator actually has password reset authority before you start to fumble through the menus.
- Open the Domino Administrator client using an account that has “password reset authority” for that user.
- Go to Tools > ID Vaults > Reset Password.
- Select the locked-out user’s ID from the list.
- Click Reset Password and set a new temporary password.
- Give the new password to the user, and have them log in as normal.
Once the user logs in with the new password, their local ID file automatically syncs back up with the vault copy in the background. From the user’s perspective, the process is almost a breeze. There’s nothing else they need to configure — it just resolves itself.
One small thing worth knowing if you’re the admin: not every admin account can do this by default. “Password reset authority” has to be explicitly assigned per user or organizational unit ahead of time. If the Reset Password option isn’t available to you, that’s usually why — someone with broader admin rights will need to grant it, or handle the reset themselves. In other words, don’t take a detour trying unrelated settings; check the assigned authority first.
Scenario B: No ID Vault, But Recovery Information Was Set Up
If your organization doesn’t use an ID Vault, don’t panic yet — there’s a second safety net called ID recovery. You may be entering slightly more uncharted waters, but the recovery path can still be straightforward., and it might already be active on your account without you realizing it.
Here’s how to check: go back to File > Security > User Security, and on the Security Basics tab, look for a button called Mail Recovery ID. If that button is active (not greyed out), recovery information exists for your ID, and recovery is possible.
Here’s the simple version of how this works, without the technical deep-dive. You don’t need a shred of knowledge about Notes security internals to follow the basic idea:
- When your ID was first set up, your administrator created it in a way that stores a special “recovery password” inside your ID file, encrypted so that only certain administrators can unlock it.
- When you’re locked out, you contact one of those administrators.
- The administrator opens their own admin ID and pulls out your recovery password from a backup copy of your ID file.
- They give you that recovery password, which unlocks your ID file so you can set a brand-new password of your own choosing.
This process does need at least one administrator who was specifically set up ahead of time to handle ID recovery for your organization — it’s not something any random IT person can do. Pro tip: if you’re unsure who that person is, ask your IT team to probe the configured recovery administrators rather than trying random accounts.
If you don’t know who that is, your regular IT contact should be able to point you in the right direction.
One important detail: every time your recovery information gets regenerated (which can happen periodically), the old recovery passwords stop working. So if an admin tries to recover your ID and it doesn’t work, it may simply mean they’re working from an outdated backup — not that something is broken.
Scenario C: No Vault, No Recovery Info — The Hard Case
This is the scenario nobody wants, but it’s worth being honest about it rather than pretending there’s always an easy fix. The fallout from losing an unrecoverable ID can be significant, particularly when encrypted data is involved.
If your ID was never enrolled in a Vault and never had recovery information set up, and you’ve genuinely forgotten your password (or the ID file itself is damaged or lost), there usually isn’t a way to unlock that specific ID file. This isn’t a HCL Notes flaw — it’s the same security principle that makes the whole system trustworthy in the first place: the password is the only key, by design.
At this point, your realistic options are:
- Check whether an older, working backup copy of your ID file exists somewhere (a previous laptop, an old backup drive, a shared IT backup location) that still has the password you remember.
- If no working copy exists, your administrator will need to issue you a brand-new Notes ID. This means a new ID file, but it also usually means losing access to anything encrypted specifically with your old ID unless it’s separately recoverable (like mail stored on the server, which is typically fine).
If you’re reading this section because it’s already happened to you, talk to your Domino administrator directly — they can probe the available backups and recovery options. They’ll know your organization’s specific setup and what’s realistically recoverable. — they’ll know your organization’s specific setup and what’s realistically recoverable. And if you’re reading this before it’s happened, the next section is exactly why it’s worth five minutes of your time.
How to Make Sure This Never Locks You Out Again
Whichever scenario you just went through, this is the part that actually saves you the headache next time. Good cyber hygiene is not just about passwords; it is also about protecting the digital footprint represented by your Notes ID and its encrypted data.
- Ask your Domino administrator whether ID Vault is available in your organization, and if so, confirm your ID is enrolled in it. This is the single best protection against a permanent lockout and is becoming the gold standard for Notes ID recovery. This is the single best protection against a permanent lockout.
- If Vault isn’t available, ask specifically whether ID recovery information has been set up for your account. If the “Mail Recovery ID” button is greyed out, it hasn’t — and it’s a quick fix for your admin to enable.
- Keep a backup copy of your current ID file somewhere safe (a company-approved backup location, not just your desktop), because a reliable backup is instrumental when your local copy is damaged or lost, so a damaged or lost laptop doesn’t become a bigger problem than it needs to be.
- If your organization uses password expiration policies, set yourself a reminder a few days before expiry so you’re never scrambling mid-shift.
Frequently Asked Questions
What’s the difference between an ID Vault and ID recovery?
An ID Vault keeps a live, continuously synced backup copy of your ID file on the server, so resets are quick and don’t need special “recovery passwords.” ID recovery is an older, separate mechanism that relies on encrypted recovery passwords stored inside your original ID file, set up ahead of time by an administrator.
Can I reset my own HCL Notes password without contacting IT?
Only if your organization has specifically enabled a self-service reset tool for ID Vault users. Otherwise, resetting requires an administrator with the correct permissions, whether you’re using ID Vault or ID recovery.
What happens if my recovery password doesn’t work?
This usually means the recovery information in your ID file was regenerated after the backup copy your administrator is using was created. Ask them to try again with the most recent backup, or check whether your ID has since been moved into an ID Vault instead.
Is it possible to lose access to my Notes ID permanently?
Yes, if your ID was never enrolled in a Vault and never had recovery information configured, and no working backup copy exists. In that case, your administrator will need to issue a new ID.
Does resetting my password delete any of my email or data?
No. Resetting your password (through either the Vault or ID recovery) only changes how you unlock your existing ID file — it doesn’t touch your mail, documents, or encryption keys. That distinction matters because an ill-advised attempt to replace or recreate an ID can have detrimental consequences for encrypted content.
Wrapping Up
Getting locked out of HCL Notes feels a lot worse than it usually is. The situation may look vivid and intimidating at first, but the solution often boils down to identifying the recovery mechanism already in place. In the vast majority of company environments, there’s a working safety net — either an ID Vault or recovery information — quietly sitting in the background for exactly this moment. The trick is knowing which one applies to you, and now you do. If you made it through this without a fix, that’s a sign it’s worth a direct conversation with your Domino administrator about setting up proper recovery for your ID before the next lockout happens.
