There are many reasons why you might want to do this, someone has managed to change a user password and that person is not available, you might simply have forgotten it. Or you might have been given a machine, or bought one from ebay that has come without a password. Also there have been a few times when a user has looked me in the eye and said “I’m typing my password in, but it’s not working”, I have never seen a password change on it’s own, so I will just put that down to the evil password gremlins.
The procedure will also work on the Windows local administrators password, just bear in mind that his account is disabled by default, (after Windows 8). This procedure will not work if the machine in question has had its hard drive encrypted using BitLocker.
You can use this procedure to blank, (or reset) a Domain Controllers DSRM (Directory Services Restore Mode) password.
You can avoid this procedure if you have access to another account on this machine that has administrative access. If you can log on as an administrator, then you can change the password of other local accounts on the affected machine without the need to do this.
2. Download ImgBurn and install, Launch the program, if it does not look like this you need to select View >EX-Mode-Picker. Select the ‘Write image file to disc’ option.
2. The file you downloaded is a zip file that contains the disk image, you will need to extract the image from the zip file (i.e. drag it to your desktop). From within ImgBurn launch the browse option and navigate to the disk image you have just extracted > Open.
3. Select the burn to disc icon (Note: This will be greyed out, until there is a blank CD in the drive). The image is very small, it will not take long to burn.
Carry Out a Windows 8 Password Reset.
This procedure uses the boot CD you have just created, for it to work you need to make sure the machine will attempt to boot to its CD/DVD Drive before it boots to its hard drive. (Or it will simply boot into Windows again). This change in ‘Boot Order’ is carried out in the machines BIOS, how you enter this varies depending on machine vendor, when you first turn on the machine watch for a message that looks like Press {key} to enter Setup. Typically Esc, Del, F1, F2, or F9. When in the BIOS locate the boot order and move the CD/DVD Drive to the top of the list.
1. Boot your machine from your freshly burned CD, when you see this screen simply press {Enter} to boot.
2. Depending on how many disks/partitions you have it will discover them and assign a number to each one, here I only have 1 so I will type ‘1 {Enter}’.
Note: You may see a small 300Mb partition, ignore that. You may also see your machines recovery partition if it has one, if that’s the case you may have to carry out some trial and error to get the right one.
3. The system is set to look for the default registry location C:WindowsSystem32Config so simply press {Enter}. If it fails at this point you selected the wrong drive/partition.
4. We want password reset so select option 1.
5. We will be editing user data and passwords, so again select option 1.
6. You will be presented with a list of the user objects that it can locate, here I want to reset the password for the ‘PeteLong’ user object so simply type in the username you want to edit.
Note: As mentioned you can see here the administrator account is disabled, if you want to work with that account, you will need to unlock and enable it on the next screen before you blank or change the password.
7. You can choose option 2 and type in a new password, but I’m going the blank the password, then change it when I get back into the machine by selecting option 1.
8. To step back you need to enter an exclamation mark.
9. Enter a ‘q’ to quit.
10. To write the changes you have made enter a ‘y’.
11. As long as you are happy, and have no other accounts that need changing, enter ‘n’.
12. Now remove the boot CD, and press Ctrl+Alt+Delete to reboot the machine.
13. As the user object we are dealing with was the last one that has logged on, it will select that account as soon as the computer boots, and now it has a blank password it will automatically log on.
14. To change the password, press Ctrl+I > Change PC settings.
15. Users > Create a password.
16. Type and confirm your new password, and enter a password hint > Next.
17. Log off the account and test the new password.
Related Articles, References, Credits, or External Links
Note: As the title suggests, this is quite an old post! you might prefer THIS ONE.
Disclaimer: This information is designed to help people who are locked out of their own PC’s and not for Hacker Wannabe’s with the IQ of a haddock. Information is not inherently dangerous, just some people are. If you want to break things and be a general pain in the ass, sod off to Google and leave the grown ups alone. Pete Long 16/05/04
Generally if people are reading this they have lost or forgotten their administrator password, the more technically astute of you will baulk at this as you know the importance of this password, the simple fact is most people don’t, and by the time they need it its on a long lost post-it note. Similarly if you buy a second hand PC from eBay for example the seller will not always furnish you with the admin password.This can be resolved by wiping the hard drive and simply re-installing windows from scratch, but the chances are there will be information you need to save of the PC and you are stuck in a catch 22 situation.
OK so how do you get into the system? Well in truth there are a myriad of ways into a PC providing you are at the keyboard.
Solution
STEP 1
To be honest the simplest solution is the one most overlooked, is the password set to blank? try just pressing enter and not putting in a password. Most people use one password for everything (though this is not very secure 🙂 use the password you would normally use and remember Windows Passwords are CaSe SEnsitiVe, so try capitalising the first letter for example.
STEP 2
Well if Step 1 didn’t help you now have a choice,If your on a network with a DOMAIN you can gain access by using a domain administrators account, or if you can get in with YOUR username Click Start > Run > lusrmgr.msc {enter} right click the administrator and see if YOU have rights to change the password. OR you can simply wipe and rebuild the system, if that’s not an option and you simply HAVE TO get into the system then proceed to STEP 3
STEP 3
OK, more choices, the simplest solution is to change the admin password, using some third party software, this will let you in with administrative access and is pretty simple to do, there are a ton of applications to do this, I’ll demonstrate the one I usually use, and provide links to other tools at the end. There’s also another option which is to change the way windows starts to simply bypass the login completely, this is a little more complex to do but I’ll run through that as well. For some of you that may not be a solution, there may be a reason that you simply need the existing password, this is considerably more complex and can only be done in one way, that involves removing all the passwords and using software to de-crypt them. (This will cost you money)
Changing the Existing Password
Lets be honest, this is what 99.9% of you will want to do, you will also need to do this on another PC that has internet access to download the files and create the boot floppy disk you require, as I’ve already said there are a lot of tools available to you the one I use is free and can be downloaded from eunet.no
NOTE: If you have encrypted files with the administrator account then these will files will be unavailable to you after carrying this out. (If your now wondering if you have – the fact you’re wondering usually indicates you don’t 🙂
From the zip file select all the files and “EXTRACT” them to your hard drive.
Now you have extracted the files you need to use them to create the boot floppy you require. Put a blank floppy disk in the floppy drive (warning all files on this disk will be wiped ensure there’s nothing important on it.)
Now either open windows explorer or double click “My Computer” and navigate to your C: drive, you are looking for a file called “install.bat” (NB on your system it may just look like “install” depending on how your machine is set up) when you locate the file double click it to run it.
The setup program will run, and ask you which drive you want to create the boot image on, press a then press {Enter}, It will ask you to put a clean floppy in the drive and press {enter}
The setup program will chug along and create the floppy for you. You will know its finished when its displayed the following, just press any key to exit.
Well that’s your tool created, its time to take it to the offending machine. For it to work the offending machine will need its boot order setting so that it boots from floppy BEFORE the hard drive, for the majority of you it will be set up this way, if it wont launch the floppy disk when you boot the PC chances are this is the problem. To rectify it you need to enter the PC’s BIOS settings and change the boot order, and put the floppy (or A: drive) first in the boot order. This procedure is slightly different depending on your PC manufacturer and the BIOS itself. When your PC first boots it usually tells you how to enter the BIOS, typically by saying “Press <key> to enter setup” where <key> is usually F1, F2, F10, Esc, Delete or another key or combination of key strokes. When you get into the BIOS navigate through the screens until you see the boot order and move floppy (or A: drive) to the top on the list.
When the PC boots a lot of info will flash up on the screen, its just loading a bit of Linux don’t panic. When it settles down it asks you where windows is (its talking in UNIX speak don’t worry) you probably only have one operating system, if your clever enough to multiboot (have multiple operating systems on one PC) then Ill assume your clever enough to locate the partition you are looking for, for the rest of you just press {Enter}
It now asks “Where is the registry” but it displays the default location so just press {Enter}
Now you want to use a thing called the SAM, don’t panic just press {Enter}
The administrator is just a user so you need to accept the default choice of “Edit user data and passwords” by pressing {Enter}
The software selects the administrator by default, if it’s another user your after you can type its username (They are all listed above to help you) but we want the administrator so just hit {Enter}
You can now either type in a new password, or simply type an asterisk (this sets a blank password), you will be asked to confirm, do so by pressing Y then {Enter} all being well you will get a “Changed!” pop up on the screen and it will ask if there is another user you want to change the password for, Press ! {Enter} to return to the main menu, then press q {Enter} you now need to COMMIT the changes, press Y then {Enter} after doing some work it will say ***** EDIT COMPLETE ****** then press n {Enter} Now remove the floppy and press Ctrl+Alt+Delete to reboot.
When windows reboots it will run its built in disk checking program “Chkdsk” DONT interrupt it, just let it do its own thing, after a while windows will boot normally and you can login with the new password. (NB: Windows XP users, if you don’t see the Administrator account listed on the welcome screen press Ctrl+Alt+Delete TWICE to get a standard login screen.)
I DONT HAVE A FLOPPY DRIVE!!!!
No problem, there are CD Based boot utilities that will do the same job 🙂
EBCD-Emergency boot CD “change password of any user, including administator of Windows NT/2000/XP OS. You do not need to know the old password.”
Change the way Windows Starts
Note:This will not work on Windows Server 2003
If you turn your PC on it will eventually get to logon, if you do nothing a screen saver will launch, this screensaver is called LOGON.SCR, all very well and good you say but what use is that? Well If you replace LOGON.SCR with the windows command line program (cmd.exe) it will launch a command line window instead, and not just any command line window, you are then typing commands with the SYSTEM rights, (This is higher than administrator)
So how is that done? Well it depends on your setup, if you have formatted the machine as FAT32 you are in luck simply download a boot disk from boot disk.com, and change.
Then reboot when the system reboots go and have a coffee, when you see the command window type
net user administrator password {Enter}
The password will now be set to password, reboot and change logon.bak to logon.scr and cmd.bak to cmd.exe
However Most people will have their machines formatted as NTFS which, being more secure is not able to be changed from a boot disk, unless its a boot disk with NTFSPro on it, then it can (WARNING THIS IS NOT FREE). Or simply remove the hard drive and place it in another (working PC) then use windows explorer to back up the logon.scr and cmd.exe files (change their extensions to .bak) and rename cmd.exe to logon.scr, Put it back in your PC and away you go.
WARNING THE FOLLOWING COSTS MONEY 🙁
If you have got this far down the page, and your not in yet, then we are going to have to break the habit of a lifetime (and spirit of this site) and spend some cash. Basically the most drastic (and time consuming) method involves removing the entire list of encrypted passwords from the inaccessible machine and decrypting them.
Your encrypted passwords are help in two locations, the first is called the SAM (system account manager) and the second is the PC’s registry.
The files you need live in the following locations….
Windows XP C:WINDOWSsystem32configSAM & C:WINDOWSsystem32configSYSTEM
WIndows 2000 C:WINNTsystem32configSAM & C:WINNTsystem32configSYSTEM
NOTE: The system file is too big to fit on a floppy if you are using floppies you will need a dos compression utility like RAR to compress it.
OK, I’ve detailed above how to get at files on a system you don’t have access to, I’d recommend putting the drive in another PC and just copying it out, If you want a FREE alternative download Knoppix (this is Linux that runs from a CD, boot with it and extract the file straight from the affected system.)
Now you have extracted the two files you need to extract the passwords this takes specialist software, the most famous is LophtCrack from @Stake software but at time of writing its nearly $600 another choice is Proactive Windows Explorer from Elcomsoft which is half the price.
Related Articles, References, Credits, or External Links
Before starting the hard drive must be formatted, refer to the PARTITIONING section for more details. You CAN format a partition that is ALLREADY formatted to “wipe it clean”.
WARNING: Formatting a Partition that contains information will DESTROY that information.
This section deals with FAT32 formatting, this is required for operating systems like Windows 95/98/ME but can also be used by Windows 2000 and XP – The only time I would recommend using FAT32 for 2K and XP, is if you are dual booting your PC with two operating systems, and still want to see ALL the drive from either operating system.
Solution
Formatting a Partition
1. First ensure you have a windows 98SE Bootdisk, you can download one, CLICK HERE
2. Boot the PC with your boot disk, ENSURE the boot order is set in the BIOS to boot from the floppy disk BEFORE the hard drive.
3. When The PC has booted simply type format c: {enter}.
4. You will get a warning that you are about to “Wipe” your drive and erase all the data. Press Y then {enter}.
5. The drive will now start formatting, depending on the drive size, this may take a while – time for a coffee :0)
6. The system will now create the File Allocation Table – This is like a “routemap” for your operating system so it can find all its files.
7. You will now be asked to enter a Volume Label, if you have a lot of partitions to do this is a good idea, i.e. Music, WorkStuff etc.
8. If you don’t want a Volume Label, just press {enter} I’m calling this one PETESDRIVE.
9. This will tell you some information about the drive, for example how big it is, this one is approx 4Gb. And that’s it finished.
Related Articles, References, Credits, or External Links
This section assumes you have multiple partitions, and goes through the steps needed to remove them using FDISK
WARNING: Removing partitions DESTROYS all the data in those partitions, make sure you have a backup of your important information.
For this example the hard drive in question has a PRIMARY partition (approx 2Gb) and two LOGICAL DRIVES (each approx 1Gb) if I’ve just confused the hell out of you CLICK HERE
Solution
Deleting Partitions
1. First ensure you have a windows 98SE Bootdisk, you can download one, CLICK HERE
2. Boot the PC with your boot disk, ENSURE the boot order is set in the BIOS to boot from the floppy disk BEFORE the hard drive.
3.To launch FDISK simply type fdisk {enter} at the command prompt, when the program launches press the Y key and {enter} to enable large drive support.
4. This is the main FDISK menu, as we are Deleting partitions we need to change the selection from the default [1] to [3] “Delete partition or logical DOS Drive” Press 3 then {enter}
5. Now remember the LOGICAL drives must be deleted FIRST so we need to select “Delete logical DOS Drive(s) in the Extended partition” Press 3 then {enter}
6. Now the system will display the logical drives, work your way BACKWARDS, the last drive letter here is E so simply push E then {enter}.
7. FDISK will ask you for the volume label – ours does not have one so we can simply press {enter} if yours does it will be listed above in the volume label column.
8. At this point you must confirm by pressing Y then {enter}
9. The default view will change to show you that E: drive has been deleted, and you can continue to delete the D: drive, simply press D then {enter}.
10. Again it will prompt for volume label (See step 8 above).
11. You will be asked to confirm press Y then {enter}.
12. You will now see the Logical drives are BOTH deleted, press Esc to exit.
13. At the confirmation page just press Esc.
14. Back at the main menu! Now the LOGICAL drives are gone you can delete the EXTENDED partition. Press 3 then {enter}.
15. To remove the EXTENDED partition press 2 then {enter}.
16. There is only one EXTENDED partition so press Y then {enter}.
17. More confirmation! Just Press Esc.
18. Now the EXTENDED Partition is gone you can remove the PRIMARY partition press 3 then {enter}.
19. Well we know we want the PRIMARY gone so press 1 then {enter}.
20. Its the only one there :0) Press 1 then {enter}.
21. If you have a volume label enter it, if not press {enter}.
22. Press Y then {enter}.
23. Confirmation screen, just press Esc.
24. Nearly done! Press Esc.
25. Press Esc to exit FDISK, when you are back at command line press Ctrl+Alt+Del to reboot the PC. All your partitions are now removed.
Now you’re done you can either repartition the drive OR if you’re installing Windows 2000 or XP let it do it for you as part of the install process.
To set up simple partitioning (One Partition, one Drive Letter) CLICK HERE
To set up complex partitioning (multiple partitions, multiple drive letters) CLICK HERE
Related Articles, References, Credits, or External Links
This section assumes you want multiple partitions, and goes through the steps needed to create them using FDISK.
For this example the hard drive in question will have a PRIMARY partition (approx 2Gb) and two LOGICAL DRIVES (each approx 1Gb) if I’ve just confused the hell out of you CLICK HERE
Solution
Creating Partitions
1. First ensure you have a windows 98SE Bootdisk, you can download one, CLICK HERE
2. Boot the PC with your boot disk, ENSURE the boot order is set in the BIOS to boot from the floppy disk BEFORE the hard drive.
3.To launch FDISK simply type fdisk {enter} at the command prompt, when the program launches press the Y key and {enter} to enable large drive support.
4. This is the main FDISK menu, as we are creating partitions we need to create a DOS partition press 1 then {enter}.
5. Now remember that PRIMARY partitions MUST be created first so press 1 then {enter}.
6. FDISK does a drive check, just wait.
7. At this point we DON’T want the default setting or the PRIMARY partition would take up the whole drive, press N then {enter}.
8. FDISK does another drive check, just wait.
9. You need to type in the size (In Megabytes) that you want the PRIMARY partition to be, this is a 4 Gb drive so I’ve typed 2048 Mb (2Gb) then press {enter}.
10. This just confirms the partition was created, press Esc.
11. Now we are back at the main menu, we need to start creating an EXTENDED partition, so press 1 then {enter}.
12. EXTENDED partition is number two so press 2 then {enter}.
13. Yet another drive check, more waiting :0)
14. Now we want to use the rest of the drive for the EXTENDED partition and by default it will show us this value. Press {enter}
15. Just a confirmation screen, we can see our nice new partitions now, press Esc.
16. Now because we’ve got an EXTENDED partition and no LOGICAL DRIVES, it gets us to create them by default, after another drive check of course :0)
17. Now by default it will try and use the whole EXTENDED partition, as we want two logical drives, we don’t want it to do this, so type in the size (In Megabytes) of the drive you want, in this case I’ve used 1024Mb (1Gb) then press {enter}.
18. And there she is! time for FDISK to do yet another drive check, just wait.
19. Now it wants us to use up the rest of the EXTENDED partition, if you want a LOT of LOGICAL DRIVES you can keep going, as we only want two just press {enter}.
20. OK there’s our two LOGICAL DRIVES and FDISK is telling us that we have used up all the EXTENDED partition, just press Esc.
21. Now the last thing we need to do is make the PRIMARY partition active (so you can boot from it) press 2 then {enter}.
22. There’s your PRIMARY partition at the top, so press 1 then {enter}.
23. Now FDISK tells us the partition is active, press Esc.
24. Back wherewe started :0) Press Esc.
25. Press Esc to exit FDISK, when you are back at command line press Ctrl+Alt+Del to reboot the PC. All your partitions are now created.
Once the PC has rebooted you can format each drive using the format c: command (substitute c for all your other drives. If you’re going to install windows 2000 or XP you won’t need to do this it can be done from the operating system setup.
Related Articles, References, Credits, or External Links
You want to remove the partitions form your carved up hard drive.
Solution
Deleting a Partition
1. First ensure you have a windows 98SE Bootdisk, you can download one, CLICK HERE
2. Boot the PC with your boot disk, ENSURE the boot order is set in the BIOS to boot from the floppy disk BEFORE the hard drive 3.To launch FDISK simply type fdisk {enter} at the command prompt, when the program launches press the Y key and {enter} to enable large drive support
4. This is the main FDISK menu, as we are Deleting a single partition we need to change the selection from the default [1] to [3] “Delete partition or logical DOS Drive”
5. Press 3 then {enter}
6. As there is only one partition leave the default setting of [1] and press {enter}
7. You will now see the partition displayed (In this case called partition 1) as this is the only partition it is selected by default, just press {enter}
8.You will now be asked to type in the “Volume Label” this drive is blank so you can just hit {enter} if yours has a label it will be shown in the volume label column (above)
9. You are asked to confirm (Last chance to change your mind :0)
10. Press Y then {enter} to confirm
11. This confirms the partition is deleted (You can now Exit FDISK if you do not want to create a partition, by pressing Esc) When you are back at command line press Ctrl+Alt+Esc to reboot the PC.
Related Articles, References, Credits, or External Links
