You can disable the mode button on access points having a console port by using the [no] boot mode-button command.
This command prevents password recovery and is used to prevent unauthorized users from gaining access to the access point CLI.
This command disables password recovery. If you lose the privileged EXEC mode password for the access point after entering this command, you will need to contact the Cisco Technical Assistance Center (TAC) to regain access to the access point CLI.
The mode button is enabled by default. Beginning in the privilege EXEC mode, follow these steps to disable the access point’s mode button.
You can check the status of the mode-button by executing the show boot or show boot mode-button commands in the privileged EXEC mode. The status does not appear in the running configuration. The following shows a typical response to the show boot and show boot mode-button commands: