Own Your CCTV: Getting Admin Passwords and a Proper Handover From the Installer (India)
Installer has the CCTV password and doesn't answer? As of 15 Oct 2026, CP Plus, Hikvision and Matrix NVRX manuals reset a forgotten admin password through the recovery email or security questions set at installation. Whoever set them controls your NVR. At handover, collect seven things: admin passwords, recovery email, app account, IP plan, firmware list, drawings, HDD details.
Last checked: 15 Oct 2026.
Verified against
- CP Plus Network Video Recorder User Manual (PDF).
- CP Plus IP Camera User Manual v2.01 (PDF).
- Hikvision Network Camera User Manual UD19347B-C, firmware V5.6.5 (PDF); Hikvision How to Reset Password on SADP (PDF).
- Hik-Partner Pro help: Hand Over Site by Transferring and Unbind a Device from Its Current Account.
- Matrix SATATYA Devices Manual, Version 8, released 6 May 2024 (PDF).
- Sparsh Support & Resources download centre and Sparsh X Camera Manual (listed 24 Jul 2026).
- MeitY OM W-43/11/2021-IPHW, CCTV advisory, 11 Mar 2024 (PDF); MeitY series guidelines in BIS's CCTV ER implementation note, 22 Oct 2024 (PDF).
- DPDP Act 2023, ss.2(i), 8(1), 8(5) (PDF); DPDP Rules 2025, G.S.R. 846(E), rules 1 and 6 (e-Gazette); CSIR-NPL time and frequency page.
- Checked 15 Oct 2026.
The recovery email is the real key
A password can be changed in a minute. The recovery settings decide who can change it later without you.
- CP Plus NVR: a forgotten admin password is reset with a code sent to the "Reserved Email" or with security-question answers, both set at first setup (§3.1). Password reset is "enabled by default" (§4.6.3).
- CP Plus camera: without password reset enabled, "you can only reset the password by resetting the camera" (v2.01, §4.7.2.2).
- Hikvision camera (V5.6.5): security questions and recovery email sit under Account Security Settings, and the questions are "not cleared when you restore the camera (not to default)" (p. 66).
- Matrix SATATYA: Forgot Password sends a 6-digit OTP to the configured email, valid 2 minutes, on NVRX/NVRX P2 series only (manual V8).
If the installer typed his own Gmail into these fields, he can take the system back after you change the password. Replace the recovery email and questions, not just the password.
Handover checklist: what you must hold
| # | Item | What to receive | Pass check | Source |
|---|---|---|---|---|
| 1 | NVR admin password | Changed in front of you, written into a sealed envelope | Log in yourself; old password fails | MeitY OM (vii) |
| 2 | Recovery email and questions | A company mailbox (e.g. [email protected]), answers only you know |
Run Forgot password once and receive the code | CP Plus NVR §3.1, §4.6.3 |
| 3 | Camera passwords | Unique per device, or a documented scheme | Three sample cameras open with the new password | MeitY OM (vii) |
| 4 | Installer's own access | A separate, named, limited account; not admin | Users list shows admin plus named roles | MeitY OM (xiv); CP Plus camera App. 1 |
| 5 | P2P / cloud app account | Registered to the company email and phone; device bound to it | The app on the owner's phone shows every recorder | CP Plus NVR §4.2.14; Hik-Partner Pro handover |
| 6 | IP plan | Sheet per device: ID, IP, MAC, switch port, location | Five random cameras match the sheet | Commissioning checklist |
| 7 | Time source | NTP server written down: NIC or NPL (time.nplindia.org) |
Overlay time matches IST | CSIR-NPL |
| 8 | Firmware versions | Version per camera and NVR model | Matches the version on the model's certificate | MeitY series guidelines, item 4 and 7 |
| 9 | Config backup | Exported file on your USB, with its password | The Config_xxxx file on your USB opens and shows the backup information |
CP Plus NVR §4.13.5.2 |
| 10 | As-built drawing | Editable file: camera positions, cable routes, rack | Labels on site match the drawing | Commissioning checklist |
| 11 | HDD details | Make, model, capacity (TB), serial, slot, install date | NVR disk page shows the same serials | NVR disk page |
| 12 | Warranty papers | Invoices with serial numbers; warranty cards per device | Serials on invoice = serials on devices | Invoice |
Item 8 matters because MeitY's series guidelines say each firmware version "must be tested separately as independent series", and the certificate must carry the "firmware version, and hash value" (BIS note, 22 Oct 2024). Check models in the CCTV certificate checker.
Where brands differ: recovery when nobody has the password
| Brand / device | Self-service recovery per vendor docs | When that is not set up | Source |
|---|---|---|---|
| CP Plus NVR | Forgot password: code to reserved email, or security questions | Mainboard reset button (selected models): power off, open cover, power on, hold 5–10 s; "all the configurations will be lost" | NVR manual §3.2, §4.13.5.3 |
| CP Plus camera | Forgot password?: code to reserved email | Reset the camera; see the CP Plus setup page | Camera manual v2.01 §4.7.2.2 |
| Hikvision camera | Forget Password → export QR code → email it to [email protected]; code arrives at the recovery email, valid 48 hours |
SADP Forget Password: send serial number and start time, an XML file or a QR code to Hikvision support; encrypted file valid 48 hours. Prama: see the Prama/Hikvision reset page | V5.6.5 manual p. 66; SADP how-to |
| Hik-Connect app binding | Installer hands the site over; the customer accepts in Hik-Connect and "becomes the site owner" | Unbind from the old account: phone on the same LAN, device password required | Transfer; Unbind |
| Matrix SATATYA NVRX / NVRX P2 | Forgot Password: email OTP (valid 2 min) or security questions | Reset button, held at least 4 s, defaults LAN, user, general and resolution settings (on models that have it) | Matrix manual V8 |
| Sparsh | No password-recovery procedure in Sparsh's public download centre; the Sparsh X Camera Manual refers to the NVR manual, which is not listed there (checked 15 Oct 2026) | Ask Sparsh support in writing | Sparsh support |
On CP Plus NVRs, the software Default keeps "network settings and user management", so it unlocks nothing; Function Default and the hardware button wipe all settings (§4.13.5.3).
If the installer has the password and doesn't answer
- Write once, with a date. Ask for the admin password, recovery email change and app-account transfer within 7 days.
- Try Forgot password. It works only if the recovery email is a company address; otherwise the code goes to him.
- Reset only with a plan. Note every camera's IP from the NVR channel list, then reset in a non-production hour.
- Re-bind the app to an account in the company's name, not a staff member's personal number.
- Re-run the commissioning checks for retention days and time sync.
Handover form template
| Field | Value | Signed by |
|---|---|---|
| NVR make, model, serial, firmware | Installer | |
| Admin password changed in owner's presence (Y/N) | Owner | |
| Recovery email set to (company address) | Owner | |
| Security questions reset by owner (Y/N) | Owner | |
| App / cloud account email and phone | Owner | |
| Installer account name and rights | Both | |
| Camera count; IP list and NTP server attached (Y/N) | Installer | |
| HDD: make, model, TB, serials | Installer | |
| Config backup file and its password delivered (Y/N) | Both | |
| As-built drawing (editable file) delivered (Y/N) | Installer | |
| Invoices and warranty cards delivered (Y/N) | Installer |
DPDP: who controls the data
Under the DPDP Act 2023, the Data Fiduciary is whoever "determines the purpose and means of processing" (s.2(i)): for factory CCTV, the company, not the installer. Section 8(1) keeps the company responsible for processing done "on its behalf by a Data Processor". Rule 6 of the DPDP Rules 2025 requires "appropriate measures to control access" and access logs, from 14 May 2027, 18 months after the Rules' 13 Nov 2025 Gazette publication (rule 1(4)). A company locked out of its own recorder will struggle to show it controls access. Where footage physically sits is covered in where factory CCTV video is stored. Remote-access exposure is in the unsecured feeds audit.
What breaks in a factory
- Staff turnover. An app account on a supervisor's personal phone leaves with him.
- Power-cut resets. A reset to "fix" a hang wipes settings; without a config backup, retention and schedules are lost.
- Separate camera network. A Hikvision unbind and SADP recovery need a phone or PC on the same LAN as the device. If cameras sit on their own subnet or VLAN, someone must be on site.
- Lockouts. With Illegal Login Lock on, a Hikvision camera rejects an IP after 7 failed admin attempts, for 30 minutes (V5.6.5 manual).
When to call the installer / what to ask the vendor
Hold the final payment until the handover form is signed. Putting these terms in the RFQ is covered in how to choose a CCTV installer. Ask the brand's support what proof of ownership they need for a password reset: invoice, serial number, or both.
Where Mama fits
Mama reads existing cameras over RTSP/ONVIF and tells the owner each morning where machines sat idle. Leave an email or phone in the form below.
FAQ
How do I reset my NVR password if the installer is not responding? Use Forgot password if the recovery email is yours. Otherwise use the brand route: Hikvision support through SADP, a mainboard reset on CP Plus models that have one, or a reset button on Matrix NVRs. A hardware reset erases the configuration.
Does a factory reset delete my recordings? The CP Plus NVR manual says a reset loses "all the configurations"; the Matrix manual lists LAN, user, general and resolution settings. Neither reset section mentions erasing recordings (checked 15 Oct 2026). Copy footage you need to USB first anyway.
Can the installer still see my cameras after I change the password? Yes, if the device is still bound to his P2P or cloud account, or his email is the recovery email. Change both.