When it does pull the 46xxsettings.txt and you can change that then you can change the password.
Change the 46xxsettings.txt file, save it and reboot the phone.
It is easier to create a DHCP server with the right settings then sending these phones back.
Here is the part you need to change:
############# LOCAL PROCEDURE ACCESS SETTINGS ############
##
## PROCSTAT specifies whether local (craft) procedures can be used to configure the telephone.
## Value Operation
## 0 Local procedures can be used (default)
## 1 Local procedures cannot be used
## Note: Be very careful before setting PROCSTAT to 1
## This parameter is supported by:
## 96x1 H.323 R6.0 and later
## 96x1 SIP R6.0 and later
## 96x0 H.323 R1.0 and later
## 96x0 SIP R1.0 and later
## 46xx H.323 R1.0 and later
## 46xx SIP R2.2 and later
## 16xx H.323 R1.0 and later
## 16CC SIP R1.0 and later
## 1603 SIP R1.0 and later
## 1692 H.323 R1.4 and later
## SET PROCSTAT 1
##
## PROCPSWD specifies an access code for access to local (craft) procedures.
## Valid values contain 0 through 7 ASCII numeric digits.
## The default value is 27238 (CRAFT) unless indicated otherwise below.
## A null value implies that an access code is not required for access.
## Note: Setting this parameter via CM (for H.323) or PPM (for SIP) is more secure
## because this file can usually be accessed and read by anyone on the network.
## Setting the value in this file is intended primarily for configurations with
## versions of telephone or server software that do not support setting this
## value from the server.
## This parameter is supported by:
## 96x1 H.323 R6.0 and later (must contain at least 4 digits for R6.2.4 and later,
## else default value 27238 is used)
## 96x1 SIP R6.0 and later
## 96x0 H.323 R1.0 and later (default is null ("") prior to R1.2, must contain at
## least 4 digits for R3.2.1 and later else default value
## 27238 is used)
## 96x0 SIP R1.0 and later (must contain at least 4 digits for R2.6.10 and later
## else default value 27238 is used)
## 46xx H.323 R1.0 and later (default is null (""))
## 46xx SIP R2.2 and later (default is null (""))
## 364x SIP R1.1 and later
## 16xx H.323 R1.0 and later (default is null ("") prior to R1.3.3, and
## must contain at least 4 digits for R1.3.3 and later)
## 16CC SIP R1.0 and later
## 1603 SIP R1.0 and later
## 1692 H.323 R1.4 and later
## SET PROCPSWD 572958
##
BAZINGA!
I'm not insane, my mother had me tested!
