diff --git a/pkg/compute/tasks/guest_qga_reset_password_task.go b/pkg/compute/tasks/guest_qga_reset_password_task.go
index 40ed5456fd..579cf5fbe6 100644
--- a/pkg/compute/tasks/guest_qga_reset_password_task.go
+++ b/pkg/compute/tasks/guest_qga_reset_password_task.go
@@ -18,6 +18,7 @@ import (
 	"context"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/pkg/util/timeutils"
 	"yunion.io/x/pkg/utils"
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
@@ -89,11 +90,13 @@ func (self *GuestQgaSetPasswordTask) OnQgaSetUserPassword(ctx context.Context, g
 
 	input := &api.ServerQgaSetPasswordInput{}
 	self.GetParams().Unmarshal(input)
-	info := make(map[string]interface{})
-	secret, _ := utils.EncryptAESBase64(guest.Id, input.Password)
-	info["login_account"] = input.Username
-	info["login_key"] = secret
-	guest.SetAllMetadata(ctx, info, self.UserCred)
+	if guest.GetMetadata(ctx, "login_account", self.UserCred) == input.Username {
+		info := make(map[string]interface{})
+		secret, _ := utils.EncryptAESBase64(guest.Id, input.Password)
+		info["login_key"] = secret
+		info["login_key_timestamp"] = timeutils.UtcNow()
+		guest.SetAllMetadata(ctx, info, self.UserCred)
+	}
 
 	logclient.AddActionLogWithContext(ctx, guest, logclient.ACT_SET_USER_PASSWORD, "", self.UserCred, true)
 	self.SetStageComplete(ctx, nil)