Google Workspace Admin Locked Out? How to Regain Super Admin Access

If you have a Google Workspace admin locked out of the Admin console and no second super admin, nobody can manage billing, admin roles or core security settings. Google offers three official ways back in: a password reset, a DNS record that proves you own the domain, and support-assisted recovery.

Which Situation Are You In?

This guide covers company accounts managed in the Admin console. For a personal @gmail.com address, see how to recover a hacked Google account or how to appeal a disabled Google account.

How to Reset a Super Admin Password

Another super admin can reset your password in the Admin console under Menu, Directory, Users, Reset password; a User Management admin can’t. With no one to ask:

1. Go to accounts.google.com/signin/recovery and enter your admin email address.
2. Click Next, then Try another way.
3. Enter the verification code Google sends to your recovery phone or email, then set a new password.
4. Forgot the admin address itself? Click Forgot email?, then enter the recovery email or phone and the full name on the account.

This needs super admin self-recovery turned on. Google says the default depends on your edition; when it’s off, Forgot password? just tells you to contact your administrator.

Reset Failed? Verify Domain Ownership

Without recovery options, the wizard asks you to prove you control the domain with a DNS record. You need the login for your domain host, which Google says is typically where you bought the domain. Lost that login too? Recover it through your registrar’s or reseller’s own support first.

Option 1: The CNAME record

1. In the recovery wizard, click Try another way until it asks you to verify your domain, then copy the unique CNAME record.
2. Open your domain host’s DNS records in a new tab.
3. Add a CNAME record: paste the unique value in the Label or Host field, enter google.com as the Destination or Target, and use TTL 3600 or the default.
4. Wait a few minutes, then click Next. If Google finds the record, the Create Password screen appears.
5. If not, enter a contact email other than the locked account, the code Google sends and answers to the account questions. Once the record is verified, Google emails a reset link.

Google says if the CNAME isn’t found within 48 hours, it emails you that recovery failed. If your DNS is hosted somewhere other than your registrar, add the record there. If you bought the domain during Workspace sign-up, Google points you to its recovery form instead.

Option 2: Support-assisted recovery

If that fails, the wizard may show Contact support, which opens the Apps Admin Toolbox. You receive a support reference number, add the CNAME or TXT record Google specifies, click Check Again and choose Request for Password Reset (Recommended). Google says DNS records can take up to 24 hours to propagate. Support may ask for the account creation date, the original sign-up email, the number of users, the billing address, and the card type and last 4 digits.

When the Only Admin Has Left the Company

If you still have an active user account on the domain, you can ask Google to promote you to super admin:

1. Sign in to your own account; Google only promotes active accounts.
2. Go to toolbox.googleapps.com/apps/recovery/form, enter your domain and click Lookup Recovery Options.
3. Select I am a user and cannot contact my administrator, click Continue and confirm your details.
4. Add the CNAME or TXT record Google gives you, then click Check Again.
5. Choose Request User Promotion (Recommended) and click Submit Request.

Google contacts the existing admins first and promotes you only if they are inactive and unresponsive. If you bought Workspace through a reseller, contact the reseller too.

If the Admin Account Was Hijacked

If you still have another super admin, work through Google’s compromised-account checklist:

1. Suspend the account in Directory, Users. Google says this resets its sign-in cookies and OAuth tokens.
2. Review Admin log events under Reporting, Audit and investigation for changes such as new admins, widening the default 7-day view.
3. Check User log events for suspicious sign-ins (up to 6 months back) and wipe unknown devices.
4. Reset the password and sign-in cookies, revoke OAuth tokens and remove app passwords.
5. Audit Admin roles and privileges on every account, and replace recovery details that aren’t legitimate.

Then enforce 2-Step Verification and turn on alerts under Menu, Rules, such as Suspicious login and User granted Admin privilege. If the attacker holds the only super admin, use the domain-verification route above and see what to do in the first hour after a hack.

Prevent the Next Lockout

Google’s admin best practices:

• Keep two or more super admins, each a different person, assigned under Directory, Users, Admin roles and privileges.
• Add a recovery phone and email to every admin, and remove a departing super admin’s recovery details right away.
• Enforce 2SV with security keys, a spare key and printed two-factor backup codes.
• Don’t use super admin for daily work. Keep a separate everyday account and delegate routine jobs to limited admin roles.
• Store your DNS host login, sign-up date and billing details somewhere safe.

What not to do

• Don’t share one admin login; the audit log can’t show who did what.
• Don’t use the locked address as your recovery contact email.
• Don’t remove a verification record before Google confirms it.
• Don’t give anyone passwords, codes or remote access. “Recovery hackers” are scams; learn how to spot fake recovery services.

When to Get Professional Help

If the registrar account sits in a former employee’s name, a documented case helps. The AccRevert team reviews the case, organizes your ownership evidence and prepares a documented request submitted through Google’s official channels. Only Google decides the outcome, so no result is promised, and we never ask for your password or login codes.

Pricing: a flat $299 case-preparation fee opens a case; a success fee of $599 for personal accounts, $999 for business accounts or $1,199 for Business Manager and ad accounts applies only if access is restored. Payment is by PayPal only. See our business account appeal service.

Frequently Asked Questions

How long does Google Workspace admin recovery take?

It depends on the route. A recovery phone or email lets you reset as soon as you enter Google’s code. On the CNAME route, Google emails you that recovery failed if the record isn’t found within 48 hours. For support-assisted recovery, Google says DNS records can take up to 24 hours to propagate.

What if I don’t know who my domain registrar is?

Check your email for the invoice from when you registered or transferred the domain; Google says the registrar appears on it. You can also search the domain at lookup.icann.org and check Registrar Information. If a reseller sold the domain, the raw RDAP response may list it.

Can a regular employee become super admin if the admin is gone?

Yes, if the employee has an active account on the domain and can prove domain ownership. Google’s recovery form has an option for users who cannot contact their administrator. Google contacts the existing admins first and promotes the requester only if they are inactive and unresponsive.

Is this the same as recovering a personal Gmail account?

No. A Workspace account belongs to your organization, so admin recovery leans on domain ownership and account details such as billing. A personal @gmail.com account uses Google’s standard account recovery; see our guide to recovering Gmail without a phone or recovery email.

Final Checklist

• Try accounts.google.com/signin/recovery first.
• Confirm you can edit your domain’s DNS records.
• Add the CNAME or TXT record exactly as Google shows it.
• Gather your sign-up date and billing details.
• Once back in, add a second super admin and enforce 2SV.

Still locked out of your Google Workspace admin? Open your recovery case with AccRevert: a flat $299 case-preparation fee starts the work, and the success fee ($599 personal, $999 business, $1,199 Business Manager or ad account) applies only if access is restored.

Related Articles

• How to Recover a Hacked Google Account
• Google Account Disabled? Appeal and Save Data
• Recover Gmail Without Phone or Recovery Email
• Business Manager Hacked? Regain Full Control