diff --git a/pkg/apis/compute/guest_const.go b/pkg/apis/compute/guest_const.go
index ab42290fe5..8574b3c3f4 100644
--- a/pkg/apis/compute/guest_const.go
+++ b/pkg/apis/compute/guest_const.go
@@ -224,6 +224,7 @@ const (
 	VM_METADATA_CREATE_PARAMS       = "create_params"
 	VM_METADATA_LOGIN_ACCOUNT       = "login_account"
 	VM_METADATA_LOGIN_KEY           = "login_key"
+	VM_METADATA_LAST_LOGIN_KEY      = "last_login_key"
 	VM_METADATA_LOGIN_KEY_TIMESTAMP = "login_key_timestamp"
 	VM_METADATA_OS_ARCH             = "os_arch"
 	VM_METADATA_OS_DISTRO           = "os_distribution"
diff --git a/pkg/compute/guestdrivers/managedvirtual.go b/pkg/compute/guestdrivers/managedvirtual.go
index 24e3737755..f44cb82cbf 100644
--- a/pkg/compute/guestdrivers/managedvirtual.go
+++ b/pkg/compute/guestdrivers/managedvirtual.go
@@ -36,7 +36,6 @@ import (
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/util/billing"
 	"yunion.io/x/onecloud/pkg/util/cloudinit"
-	"yunion.io/x/onecloud/pkg/util/seclib2"
 )
 
 type SManagedVirtualizedGuestDriver struct {
@@ -492,11 +491,8 @@ func (self *SManagedVirtualizedGuestDriver) RemoteDeployGuestForDeploy(ctx conte
 			return e
 		}
 
-		//解绑秘钥后需要重置密码
-		if deleteKeypair {
-			desc.Password = seclib2.RandomPassword2(12)
-			return iVM.DeployVM(ctx, desc.Name, desc.Account, desc.Password, desc.PublicKey, false, desc.Description)
-		}
+		//可以从秘钥解密旧密码
+		desc.Password = guest.GetOldPassword(ctx, task.GetUserCred())
 		return nil
 	}()
 	if err != nil {
diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go
index c44635f80d..3d879cfa9b 100644
--- a/pkg/compute/models/guest_actions.go
+++ b/pkg/compute/models/guest_actions.go
@@ -23,6 +23,7 @@ import (
 	"strconv"
 	"strings"
 	"time"
+	"unicode"
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
@@ -521,12 +522,35 @@ func (self *SGuest) AllowPerformDeploy(ctx context.Context, userCred mcclient.To
 	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "deploy")
 }
 
+func (self *SGuest) saveOldPassword(ctx context.Context, userCred mcclient.TokenCredential) {
+	loginKey := self.GetMetadata(api.VM_METADATA_LOGIN_KEY, userCred)
+	if len(loginKey) > 0 {
+		password, err := utils.DescryptAESBase64(self.Id, loginKey)
+		if err == nil && len(password) <= 30 {
+			for _, r := range password {
+				if !unicode.IsPrint(r) {
+					return
+				}
+			}
+			self.SetMetadata(ctx, api.VM_METADATA_LAST_LOGIN_KEY, loginKey, userCred)
+		}
+	}
+}
+
+func (self *SGuest) GetOldPassword(ctx context.Context, userCred mcclient.TokenCredential) string {
+	loginSecret := self.GetMetadata(api.VM_METADATA_LAST_LOGIN_KEY, userCred)
+	password, _ := utils.DescryptAESBase64(self.Id, loginSecret)
+	return password
+}
+
 func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
 	kwargs, ok := data.(*jsonutils.JSONDict)
 	if !ok {
 		return nil, fmt.Errorf("Parse query body error")
 	}
 
+	self.saveOldPassword(ctx, userCred)
+
 	if kwargs.Contains("__delete_keypair__") || kwargs.Contains("keypair") {
 		var kpId string
 
diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go
index 03b03cde78..c0f45d8c8e 100644
--- a/pkg/compute/models/guests.go
+++ b/pkg/compute/models/guests.go
@@ -3957,6 +3957,7 @@ func (self *SGuest) SaveDeployInfo(ctx context.Context, userCred mcclient.TokenC
 		info["os_language"] = lang
 	}
 	self.SetAllMetadata(ctx, info, userCred)
+	self.saveOldPassword(ctx, userCred)
 }
 
 func (self *SGuest) isAllDisksReady() bool {