How to reset a password or disable a user in Epicor Kinetic: a practical admin guide

Key facts

• User Account Maintenance (Ice.SysUserFile) is the core administrative screen for managing user credentials, security groups, company/site access, and account status.
• Locked vs. Disabled: An account is Locked automatically by the system when a user exceeds the maximum allowed failed login attempts. An account is Disabled manually by an administrator to permanently revoke access.
• The "Send Email is empty" Error: When triggering a password reset in User Account Maintenance, Epicor requires a valid email address on the user's record and configured SMTP settings in Company Maintenance / System Agent. Without an email, the reset action aborts.
• Referential Integrity Blocks Deletion: User IDs are permanently recorded on transaction headers, audit logs, and GL journals. Epicor's Business Objects explicitly block deleting any user tied to historical records.
• Scheduled Tasks Trap: Recurring Task Agent schedules (Ice.SysTaskSchedule) execute under the security context of the user who submitted them. Disabling a key user (such as a controller or IT admin) halts their recurring batch jobs.
• Approval Queue Trap: If a disabled user is an Authorized Buyer or Invoice Approver, pending purchase orders and AP invoices become stranded in unapproved status.

Epicor authentication architectures: Where passwords live

Before attempting a password reset, identify your organization's authentication mode:

1. Native Epicor Authentication (Basic Auth):
   • Credentials are encrypted and stored directly in the Epicor database (Ice.SysUserFile).
   • Password complexity, minimum length, expiration frequency (e.g., 90 days), and lockout thresholds are governed by Company Configuration or Epicor Password Policy.
   • Administrators reset passwords directly in User Account Maintenance.

1. Single Sign-On (SSO) / Epicor Identity Provider (IdP) / Microsoft Entra ID (Azure AD):
   • Authentication is federated. Epicor maps the internal User ID to the corporate directory via the user's User Principal Name (UPN) or email address.
   • Password rules, multi-factor authentication (MFA), and password resets are controlled entirely in Azure AD / Microsoft 365 Admin Center.
   • Using "Reset Password" in Epicor for an IdP user is either unavailable or has no impact on their login.
   • However, checking "Account Disabled" in Epicor User Account Maintenance DOES immediately revoke ERP access, even if the corporate Microsoft account remains active.

How to reset a password (native Epicor authentication)

For organizations using native Epicor credentials:

1. Verify Identity: Enforce standard organizational verification before executing any credential reset.
2. Open User Account Maintenance: Search the Kinetic menu for User Account Maintenance (Path: System Setup > Security Maintenance > User Account Maintenance).
3. Retrieve User Record: Search for and select the affected User ID.
4. Verify Email Address: Confirm that the Email Address field contains a valid address. The temporary reset token will be delivered here.
5. Clear Lockouts: Check if the User Account Locked checkbox is selected. If checked, uncheck it.
6. Trigger Password Reset:
   • In the Kinetic overflow/Actions menu, select Reset Password.
   • A dialog displays the destination email address. Confirm the prompt.
   • Epicor generates a cryptographically random temporary password and sends it via SMTP.
7. User Sign-In: Instruct the user to sign in using the temporary password. Epicor will immediately prompt them to establish a new password that complies with system complexity requirements.

Fixing the "Send Email is empty" Error

If an administrator receives the error "Send Email is empty" or "User does not have an email address configured":

• Root Cause: The user record lacks an email address, or the ERP environment lacks an active SMTP configuration in System Agent.
• Resolution A (Recommended): Enter the employee's work email address into the Email Address field on the Detail tab, click Save, and re-trigger Reset Password.
• Resolution B (Manual Override - On-Premises/EAC): In self-hosted or dedicated environments via the Epicor Administration Console (EAC) or User Account Maintenance:
  • Manually enter a temporary password into the Password and Confirm Password fields.
  • Check the box Require Password Change on Next Logon.
  • Click Save and communicate the temporary password securely via an out-of-band channel.

How to unlock a Locked user Account

When a user enters the wrong password multiple times, Kinetic locks the account to prevent brute-force attacks:

1. Open User Account Maintenance and load the user record.
2. In the Detail card, locate the User Account Locked checkbox.
3. Uncheck User Account Locked.
4. Verify that Account Disabled is NOT checked.
5. Click Save.
6. The user can now attempt sign-in immediately with their existing password. (A password reset is only necessary if they cannot remember it).

Integration & REST API accounts: A preventable outage

Integrations connecting via Epicor REST API v1 or v2 (such as eCommerce platforms, MES terminals, WMS scanners, or EDI translators) often authenticate using basic credentials.

• The Problem: If an integration account is governed by standard user expiration policies, the account password will expire (e.g., every 90 days), instantly breaking production data pipelines with HTTP 401 Unauthorized errors.
• The Best Practice:
  • Create dedicated service accounts (e.g., svc_rest_wms, svc_api_ecommerce) rather than using individual personal accounts.
  • In User Account Maintenance, check the Password Never Dies (or Password Never Expires) checkbox on the service user record.
  • Restrict the account using Access Scope Maintenance so the API user only has permission to call specific Business Objects or BAQs.
  • Store the service credentials in an enterprise secrets manager—never hardcode them into application scripts.

Disable, Never delete: The audit & Offboarding workflow

Attempting to delete a user account in Epicor is almost always rejected by the Business Object runtime because the UserID is referenced as a foreign key across hundreds of historical tables (PartTran.CreatedBy, OrderHed.ChangeUser, APInvHed, GLJrnDtl, etc.). Bypassing this via direct SQL delete breaks referential integrity and voids audit compliance.

The Complete 8-Step Epicor Offboarding Checklist

Follow this checklist whenever an employee leaves the organization:

1. Disable the User Account:
   • In User Account Maintenance, check Account Disabled (Ice.SysUserFile.UserDisabled = true).
   • Terminate active client sessions under the Sessions tab.
   • Click Save. Sign-in is blocked immediately across all browser and desktop clients.

1. Audit and Reassign System Monitor Scheduled Tasks (CRITICAL):
   • Recurring tasks submitted by this user (such as Nightly MRP, Generate PO Suggestions, Capture COS/WIP, Auto-Invoice Posting) will fail to execute once the user is disabled.
   • Open System Monitor > Scheduled Tasks tab (or query Ice.SysTaskSchedule where SubmitUser = 'USER').
   • Identify every active schedule owned by this user.
   • Delete and re-submit each recurring schedule under a dedicated System/Service Account (such as manager or epicor_services).

1. Reassign Buyer Authority & PO Approval Limits:
   • Open Buyer Maintenance (Material Management > Purchase Management > Setup > Buyer).
   • If the user is listed as an Authorized Buyer or an Approval Person for other buyers, reassign their open purchase orders and update the approval hierarchy.
   • Unapproved POs routed to a disabled buyer cannot proceed without reassignment.

1. Reassign Accounts Payable Approval Roles:
   • In AP Invoice Approval, verify whether invoices are waiting in approval queues routed to this user ID. Reassign pending invoices to an active controller or manager.

1. Reassign Salesperson / Territory Ownership:
   • In Salesperson Maintenance, check if the user is linked to active customer accounts or sales territories. Reassign active customer accounts to prevent order routing delays.

1. Review Workflows and Epicor Task Sets:
   • Check Task Set Maintenance and CRM/Case/Project task templates. If the user is assigned as a default task owner for projects, engineering changes, or quality non-conformances, reassign them.

1. Audit REST API Keys & Integration Ownership:
   • Verify whether any external system, scheduled script, or API key was generated under this user's credentials. Transfer integrations to a dedicated service account.

1. Revoke Single Sign-On (IdP / Entra ID):
   • Disable the user's account in Microsoft Entra ID / Active Directory to prevent corporate perimeter access.

Administrator Security Best Practices

• Enforce Least Privilege: Only assign the Security Manager flag (SysUserFile.SecurityMgr = true) to system administrators who genuinely require unrestricted access to system setup, BPMs, and user administration.
• Do Not Share Administrative Accounts: Prohibit multiple IT team members from sharing the default manager account. Use named administrative accounts to preserve a defensible audit trail.
• Periodic Security Audits: Run quarterly BAQ reports against Ice.SysUserFile to identify dormant accounts (no login within 90 days), accounts with Password Never Dies enabled, and users assigned to privileged Security Groups.
• Naming Conventions for Inactive Users: Some organizations prefix disabled accounts with z_ or INACTIVE_ (e.g., z_jdoe). This groups inactive accounts at the bottom of search lookups without altering historical transaction references.

FAQ

How do I reset a user's password in Epicor Kinetic?

In User Account Maintenance, open the user's record, verify their email address, and select Actions > Reset Password. Epicor generates a temporary password and emails it to the user.

Can I delete a user account when an employee leaves the company?

No. Epicor prevents deleting accounts that are referenced in transactional history (OrderHed, PartTran, GLJrnDtl, etc.). The supported procedure is checking the "Account Disabled" checkbox.

Why do scheduled reports and MRP fail after an employee leaves?

Recurring tasks in System Monitor run under the security context of the user who submitted them (Ice.SysTaskSchedule.SubmitUser). If that user is disabled, the Task Agent fails to run the jobs. Always reassign recurring schedules to a service account before disabling a user.

How do I unlock a user who got locked out after multiple failed login attempts?

Open User Account Maintenance, find the user record, uncheck "User Account Locked", and save. A password reset is not required unless the user has forgotten their password.

Why do I get a "Send Email is empty" error when resetting a password?

The user record does not have a valid email address entered on the Detail tab, or Epicor's global SMTP server is not configured in System Agent.

Does resetting a password in Epicor work for Single Sign-On (SSO / Azure AD) users?

No. SSO / Microsoft Entra ID users must reset their password in Microsoft 365 or your corporate identity provider. However, checking "Account Disabled" in Epicor immediately blocks ERP access regardless of SSO status.

How do I prevent REST API integration accounts from failing due to password expiration?

In User Account Maintenance, check "Password Never Dies" on the integration account record, use Access Scopes to restrict permissions, and store credentials in a secure secrets manager.

References

Cross-check against official Epicor documentation matching your release and hosting model:

• Epicor Kinetic Help: User Account Maintenance & Security Group Assignment
• Epicor Kinetic Help: Password Policy Administration & Complexity Configuration
• Epicor Kinetic Help: System Monitor – Managing and Resubmitting Scheduled Tasks
• Epicor Kinetic Help: Buyer Maintenance & Purchase Order Approval Hierarchies
• Epicor EpicCare KB: Resolving "Send Email is Empty" Errors in Password Reset
• Epicor EpicCare KB: User Account Deletion Constraints and Relational Integrity
• EpiUsers Community: Best Practices for Disabling Users Without Breaking Scheduled Tasks
• EpiUsers Community: Managing Integration Accounts and Password Never Dies Policies