This is the example of how a device gets locked as it ignores the onetime password message from console logs.

Note: This procedure wipes out the existing configuration, so please take a backup of the configuration if possible before you proceed further. This is the new message that you see on the console as soon login with default admin/admin credentials. Sep 23 20:36:03.133: SDWAN INFO: WARNING: Please configure a new username and password one-time user admin is removed. This article gives a detailed procedure on how to recover.

This is especially dangerous during initial router setup if control connection with vManage controller is not established yet and you can't simply attach new template with username and password set. To start with XE-SDWAN version 16.10.3, you have a default one-time admin password due to security reasons which can be easily ignored by the user and potentially can get into a user lock situation. This document describes the procedure to recover the password on XE-SDWAN.

Easy file locker invalid password