If you lose the nsroot account password, follow the below steps to reset the password back to the default password.
For this example, I am running a VPX on Hyper-V. The steps will not be different or much different from VPX’s running on other Hypervisors or MPX models.
Connect to the console session of the VPX appliance and reboot the box.
On your keyboard press CTRL + C when you receive the prompt to do so as shown below. You’ll receive an OK message at the end.
Type boot -s and hit enter. This boots NetScaler into single user mode.
Press enter on your keyboard when you see the Enter full pathname message. 
Firstly, you need to check the consistency of the flash partition. On VPX appliances running on Hyper-V, the flash drive partition is named ad0s1a. Enter commmand /sbin/fsck_ufs /dev/ad0s1a and you should get a FILE SYSTEM IS CLEAN return message.
Note: To verify the name of your flash drive see https://support.citrix.com/article/CTX122687 
Now mount the flash partition using command /sbin/mount /dev/ad0s1a /flash. 
To display a list of mounted partitions and confirm flash is mounted run command df. 
Run command cd /flash/nsconfig to change to the nsconfig directory and run the following four commands:
grep -v “set system user nsroot” ns.conf > newns.conf -This command creates a new configuration file newns.conf that has an nsroot user with the default password.
mv ns.conf backupns.conf -This command backs up the current ns.conf file to a file called backupns.conf incase you need to restore.
mv newns.conf ns.conf – This command renames newns.conf to ns.conf so it is now in command of configuration.
reboot – This command reboots the box.
When the NetScaler appliances comes back online, you can log on to the nsroot account using the default creentials. Change the password via GUI or via CLI command set system user nsroot password.
anthony
November 21, 2017the info very helpful, i try your info to reset nsroot password, my don’t have this file ad0s1a just dev/md0 when mount it keep said it busy, NS 11.1 vmware, please advise. thanks
George Spiers
November 22, 2017On VMware the flash drive is named “da0s1a” and is found under “/dev/” as normal.
ctxfan
November 25, 2019Is there some kind of trick to pressing CTRL + C to ensure that it works every time? It usually takes me 5-6 attempts before I will get one that works.
Ritvik
February 20, 2020Device Names for Flash Drive:
The following models use the /dev/ad0s1a device name for the flash disk:
7000 9010 9950 10010 12000 MPX-15000 MPX-17000
The following models use the /dev/ ad4s1a device name for the flash drive:
MPX-5500 MPX-7500 MPX-9500 MPX-9700 MPX-10500 MPX-12500 MPX-13500
Pingback: Netscaler Default - How To Set Up Netscaler Sdx Initial Network Configurations
Anonymous
February 14, 2022just searched a while for ESX Flash:
/dev/da0s1a
Marco z
February 14, 2022just searched a while for ESX Flash:
/dev/da0s1a