How to Recover a Forgotten EES Password Using Your CAC

EES, the Evaluation Entry System, sits at the centre of how the U.S. Army captures and routes NCOERs, OERs, and AERs through the rater chain. A forgotten password on this system can stall an entire evaluation cycle, leaving senior raters waiting while Soldiers chase paperwork instead of focusing on duty. For personnel posted to Australian Defence Force facilities or running joint exercises out of Townsville, the delay can ripple across two time zones and a busy rotation schedule.

The good news is that EES was built to authenticate against your Common Access Card, which means most recovery steps do not depend on a separate password manager or a phone-based reset. The CAC itself, with its PKI certificates and PIN, functions as the key. Understanding how those two layers interact is the difference between being locked out for an afternoon and being locked out for a week.

This guide walks through the recovery flow from the first browser prompt to the final confirmation page. It also flags the spots where Soldiers typically stall, the way iPERMS records may be involved, and what to do when the standard reset is not enough. Anyone working from a base in Brisbane, Sydney, or even a quieter training area near Wagga Wagga will follow the same steps, since EES is a web-based portal with no regional lockout.

Before starting, confirm your CAC reader drivers are current and your middleware is the latest release from your manufacturer. Outdated drivers are the single biggest reason CAC logins fail, and they are often mistaken for password problems. A quick check on your laptop before reaching for the recovery wizard can save thirty minutes of needless effort.

Understanding how EES uses your CAC and PIN

EES does not actually store a traditional account password the way a personal email account does. When you insert the card and select the correct certificate, the system reads your PKI identity and then asks for a secondary PIN, often called the EES password out of habit. This PIN is tied to the certificate on the card rather than to a central server, which changes the recovery process significantly.

The first thing to confirm is which certificate your browser is offering. Many home computers show two or three certificates, especially after a long period of inactivity, and selecting the wrong one triggers the "invalid credentials" loop that mimics a forgotten password. Open your certificate manager and look for one labelled with your DoD ID number, an issuer of DOD CA, and a status of Valid.

If your certificates have expired, the system will refuse the login regardless of how many times you reset the PIN. This is why Soldiers posted across the Pacific, including those on Pacific Pathways rotations through Australia, sometimes find themselves locked out after long field exercises. Renewing certificates through RAPIDS or your unit's S2/G6 section is the only path forward in that case.

When certificates are healthy and the right one is selected, the remaining failure point is the PIN itself. EES ties this PIN to the card's email certificate, which means a forgotten EES password is really a forgotten email certificate PIN. Resetting it requires either remembering a previous PIN to set a new one, or having your card reissued at RAPIDS.

Running the CAC password reset procedure

Begin by closing every browser window and clearing cached certificates, since stale data will block a fresh PIN from being accepted. Open a clean browser session, insert your CAC, and navigate to the EES portal. Do not use an old bookmark pointing to a test mirror, as these have different authentication paths and can confuse the reset flow.

When the PIN prompt appears, type your current best guess. If the card has not been used in months, your previous PIN may still be valid, and you can change it immediately under the certificate management option. If no PIN works, you will need to visit RAPIDS in person. Many Soldiers temporarily based in Australia handle this through coordination with their rear detachment or by scheduling a visit back to a CONUS installation.

Once a working PIN is restored, sign in to EES and confirm that the home screen loads your rater profile without errors. A clean landing page is the strongest indicator that authentication is healthy. If you see "session expired" or "invalid credentials" again, the issue is more likely certificate based, and you should revisit the previous section.

Keep in mind that supporting services such as iPERMS also read the same CAC and may share the same PIN. If you are completing a wider review of your records, it is worth checking how to verify your iperms documents are complete at the same time, so you do not repeat the certificate selection step on another day.

Common errors that mimic a forgotten password

A surprising number of recovery requests come from Soldiers who do not actually have a password problem. Browser caching, expired certificates, time skew on the local machine, and revoked credentials can all present as a forgotten EES password. Recognising these false alarms saves a trip to RAPIDS and keeps your evaluation timeline on track.

One recurring culprit is the system clock on a personal laptop. If your machine's clock drifts more than a few minutes from the DoD time source, certificate validation silently fails, and EES treats the login attempt as suspicious. Syncing against an authoritative time server resolves the issue without any password reset.

Another common mistake is selecting the wrong certificate when multiple DoD-affiliated certificates are present. Personnel with dual roles, including those who have changed units or accessed AKO and MyPay from the same machine, often see several valid certificates. Picking the wrong one produces the same error message as a wrong PIN, which leads many users down the wrong troubleshooting path.

Finally, pay attention to VPN and network settings. Some Australian home networks route traffic in ways that interfere with CRL checks. If your CAC works at the office but fails at home, try switching networks or temporarily disabling IPv6 to see whether the certificate chain validates. These small environment tweaks can resolve what looks like a deeper authentication problem.

Verifying your access after the reset

After a successful reset, it pays to test every corner of EES that you normally touch. Sign in, open your draft evaluations, check that your rater profile loads, and confirm that you can save without an error. Treat this as a smoke test rather than a full workflow, but cover enough of the system to be confident nothing is half-working.

If you handle OERs as part of your duties, take a moment to also review how to find your oer from a previous deployment, since older records sometimes hide inside the iPERMS cross-link rather than inside EES itself. Confirming this side door works ensures that you are not caught off guard when a senior rater asks for a specific deployment cycle.

Make sure the system also lets you submit a draft for higher-level review. The final submission step is often the strictest in terms of permissions, and it is the one that will catch lingering certificate issues first. If you can complete this without errors, your CAC and PIN are healthy across the board.

Soldiers often consult broader reference hubs such as military admin guides and general support resources to plan their full evaluation workflow around a password reset. These platforms outline how administrative workflows sit alongside password management, which can help frame your next steps.

When standard recovery falls short

If you have renewed your PIN, confirmed your certificates, and still cannot reach the EES home page, it is time to escalate. The first stop is your unit's S2/G6 or the local NETCOM help desk, since they can read server-side logs that you cannot see. Be ready with your DoD ID number, your card serial number, and the exact timestamp of your last successful login.

For older records or evaluations that have to be retrieved from previous duty stations, the recovery path sometimes overlaps with the formal sign and submit evaluation to hqda process. Understanding that workflow helps you frame your request accurately and avoids back-and-forth with the help desk.

Soldiers based at Australian installations should also keep an eye on time zone differences when calling U.S. help lines. East Coast afternoon business hours match well with an Australian morning, which is often the best window to reach a live agent rather than a queue.

As a last resort, a card reissue through RAPIDS will reset everything tied to the CAC, including the email certificate PIN that EES relies on. Plan a full morning for this, since the appointment includes identity verification and a fresh card printing.

Method	Speed	Requires RAPIDS Visit	Best For
Remember current PIN and set new one	Immediate	No	Routine PIN changes
Browser and cache reset	Minutes	No	Stale certificate selections
Certificate renewal through S2	Hours to a day	No	Expired or revoked certificates
Full RAPIDS card reissue	Same day to 48 hours	Yes	Lost card or locked certificates

Habits that keep your EES access healthy

A few small habits keep CAC-based logins smooth across the long term.

• Sign in to EES at least once every few weeks so the system recognises your card.
• Store your PIN in a personal password manager rather than on a sticky note near the reader.
• Update your middleware and reader drivers after every laptop OS upgrade.
• Test your certificates from a clean profile once a quarter.
• Keep a record of your last successful login date for help desk calls.
• Avoid using public Wi-Fi when first authenticating after a long absence.
• Renew certificates early rather than waiting for them to expire during a critical evaluation window.