I realize this solution may have limited application but I have been able to recover access to production switches with lost passwords using NAC manager. I pushed a switch management policy to the switch and was able to log in via RADIUS. NAC uses SNMP credentials to configure RADIUS on the switch. Glad I was able to recover access but do wonder if that is a security hole.