Google Workspace Account Recovery: What to Do When You're Locked Out
Somewhere in the chaos of running a business, the Google Workspace admin password got lost. Maybe the person who set it up left years ago. Maybe nobody remembers signing up for Google Workspace in the first place—it was 2014, someone needed email for the company domain, and now that ancient account is blocking a new setup. Maybe the phone with the authenticator app is sitting in a drawer with a cracked screen, or the only super admin is unreachable and nobody thought to ask for credentials before they left.
These scenarios play out constantly. And when they do, the recovery process ranges from “mildly inconvenient” to “weeks of proving you own your own domain.”
How Lockouts Actually Happen
Most Google Workspace lockouts fall into one of these scenarios:
The Only Admin Left the Company
This is the most common disaster we see. A company has one person with super admin privileges—often the founder, the original IT person, or whoever set up the account years ago. That person leaves, retires, or becomes unreachable. Nobody else has admin access. Nobody knows the password. Nobody has the recovery codes.
Now you have a company full of employees using Google Workspace, and zero ability to manage anything: no password resets, no new users, no security controls.
2-Step Verification Lockout
Your admin set up 2-Step Verification (good) but only configured it on one device (bad). That device is now lost, broken, stolen, or the phone number changed. Without the second factor, you can’t sign in, even with the correct password.
If your admin was also the only person with backup codes—or if backup codes were never generated—you’re stuck.
Forgotten Password with No Recovery Options
Super admins can add a recovery email and phone number to their accounts. Many don’t. When a forgotten password meets an account with no recovery options, the only path forward is proving domain ownership through DNS records.
Payment Failure
This one catches people off guard. If your payment method fails for 30 days, Google suspends the entire Workspace account—admins and users alike. Everyone loses access to their email, documents, and calendar. The account isn’t deleted, but nobody can sign in until payment is restored.
The Forgotten Account
Sometimes the problem isn’t recovering an account—it’s discovering one exists at all. A company decides to set up Google Workspace, only to find their domain is already claimed by an account nobody remembers creating. Maybe a former employee set it up years ago for a quick project. Maybe someone signed up for a free trial during the G Suite era and forgot about it. Maybe the founder created it in 2012 and moved on to other tools.
That orphaned account now blocks any new Workspace setup on the domain. And since nobody knows the admin credentials—or even who created it—recovery becomes an archaeological expedition through old emails and DNS records.
The Recovery Process: What You’re Actually Facing
If you’re locked out, here’s what the recovery path looks like:
Option 1: Another Super Admin Resets Your Password
If your organization has multiple super admins, any of them can reset another admin’s password from the admin console. Recovery takes about two minutes.
This is why Google recommends 2-6 super admins depending on organization size. But if you’re reading this article, you probably don’t have that luxury.
Option 2: Self-Recovery via Email or Phone
Go to accounts.google.com/signin/recovery and enter your admin email address. If you previously added a recovery email or phone number to the account, Google will send a verification code.
Follow the prompts, reset your password, and you’re back in.
If you never set up recovery options—which is surprisingly common—this path is closed.
Option 3: Domain Verification via CNAME Record
When the automated options fail, Google’s recovery wizard asks you to prove you control the domain by adding a CNAME record to your DNS settings.
Here’s how it works:
- Google provides a unique CNAME value
- You add that record through your domain registrar (GoDaddy, Namecheap, Cloudflare, etc.)
- Google checks for the record
The catch: You have to wait up to 48 hours for Google to verify the record. If it’s not found within that window, the recovery attempt fails and you start over.
This assumes you have access to your domain’s DNS settings. If the same person who controlled the Workspace account also controlled the domain registrar—and they’re gone—you now have two problems.
Option 4: Contact Google Support
If domain verification fails or isn’t an option, you can contact Google Workspace Support directly. Be prepared to prove you own the account by providing:
- The date the account was created (search for a welcome email from gsuite-noreply@google.com)
- The original recovery email address used when signing up
- Your Google order number (if you purchased through Google directly)
- Evidence of domain ownership and data within the domain
Response times vary. Some cases resolve in days. Others take weeks.
Option 5: User Account Promotion (When the Admin is Unreachable)
If you’re a regular user and your admin has disappeared, Google offers a path to promote your user account to super admin. You’ll need to prove domain ownership using the same CNAME verification process.
Start at toolbox.googleapps.com/apps/recovery/form and follow the instructions.
While You’re Locked Out: What’s Happening to Your Business
During recovery, the clock is ticking. Depending on your situation:
- Employees can’t get password resets. Anyone who forgets their password or gets locked out of their own account is stuck until an admin returns.
- No new users can be created. New hires can’t get email addresses.
- Security settings can’t be changed. If someone’s account is compromised, you can’t suspend it, reset the password, or revoke sessions.
- Billing issues can’t be resolved. If your account needs payment updates, nobody can access the billing section.
- You can’t manage anything. App access, shared drives, mobile devices, security alerts—all frozen.
For a small business, this can mean days or weeks of operational friction. For larger organizations, it can become a crisis.
How to Prevent This Entirely
The recovery process exists because Google has to balance security with access. They can’t just hand over accounts to anyone who claims to own them. But that security measure becomes painful when you’re on the wrong side of it.
Here’s how to avoid ever being in that situation:
Have Multiple Super Admins
Google recommends 2-6 super admins depending on your organization’s size. At minimum, have two people who can reset each other’s passwords and generate backup codes.
Create a “Break Glass” Admin Account
Set up a super admin account that isn’t tied to any individual person—something like emergency-admin@yourdomain.com. Secure it with a strong password stored in a physical safe or a highly secure password manager. Only use it for emergencies.
Configure Recovery Options on All Admin Accounts
Every super admin should have a recovery phone number and recovery email address configured. These should be personal accounts that won’t be affected if the Workspace account has issues.
Generate and Store Backup Codes
When you enable 2-Step Verification, Google generates one-time backup codes. Print these and store them securely. If your authenticator app stops working, these codes are your way back in.
Audit Admin Access Regularly
At least once a year, review who has super admin privileges. Remove former employees. Verify that current admins still have access to their recovery methods.
Keep Your Payment Method Current
Set calendar reminders to verify your billing information before credit cards expire. A failed payment can suspend your entire organization.
Why Working with a Google Workspace Partner Changes Everything
Setting up and maintaining all of this takes time and expertise. Most businesses don’t have dedicated IT staff who specialize in Google Workspace, so these best practices get skipped—until they become urgent.
That’s where working with a Google Workspace partner makes a difference.
We Set Things Up Right From the Start
When we migrate a company to Google Workspace or take over management of an existing account, we ensure the admin structure is correct: multiple super admins, recovery options configured, backup codes generated and stored, and documentation of who has access to what.
We Catch Problems Before They Become Crises
We monitor account health, billing status, and security settings. If something looks wrong—like an expiring credit card or an admin account that’s been inactive for months—we address it before it causes a lockout.
We Can Help Recover Access
If you’re already locked out, we’ve been through this process many times. We know the steps, the gotchas, and how to work with Google Support effectively. As a Google Workspace partner, we have established relationships that can help expedite resolution.
You’re Never the Only Admin
When you work with us, we maintain authorized access to your admin console as part of our managed services agreement. If your internal admins are unavailable, we can step in without going through the recovery process.
The Bottom Line
Getting locked out of your Google Workspace admin account is stressful, disruptive, and entirely preventable. The recovery process exists for a reason—it keeps bad actors from stealing accounts—but that same process makes legitimate recovery painful.
The solution isn’t to avoid 2-Step Verification or skip security measures. The solution is to set things up correctly from the beginning: multiple admins, configured recovery options, stored backup codes, and regular audits.
If you don’t have the time or expertise to manage this yourself, working with a Google Workspace partner like 2Fifteen Tech means you don’t have to. We handle the setup, the monitoring, and the recovery—so you never have to spend 48 hours hoping a CNAME record propagates.