Thanks John, that worked.  We also found that the 'set cfg-share enable' doesn't need to be run; it was already enabled.  Also, the config share writes over most of the config (seems high level settings like radio enable/disable), but leaves the network and lower level settings (channel and power settings on the radios) as is.  For anyone trying this, I would try in a lab first, but seems to work really well. Thanks again.

You can set the APs controller address within the command line. config t wireless ap-ip default-ap switch-ip RFS4000(config-wireless)#ap-ip default-ap switch-ip ?   add          Add static switch IP addresses   delete       Delete static switch IP address   set-default  default switch IP addresses As you can see you can add or remove controller IP address. So remove the bogus IP address via the wireless context of config mode. config t wireless ap-ip default-ap switch-ip delete ap-ip default-ap switch-ip add ctrl z wr /smiley face

The previous post works only for dependant APs like the ap300 or ap650. Alternatively you could log into an AP7131 and correct the Adoption IPs. Replace the incorrect setting with a correct IP address. if the incorrect IP is the second ip in the config. SSH to an AP7131. system aap-setup set ipadr 2 save .. config set cfg-share enable save .. .. stats send-cfg-all this will send all aps on the local subnet the config of the AP you are logged into. So hopefully you have a large number of access points on each lan subnet. You would have to do this to at least on ap per site or subnet. Hope that helps.