Windows – Lost / Forgotten Password?

Posted on 17/11/2018 by Migrated

KB ID 0000755

Problem

There are many reasons why you might want to do this, someone has managed to change a user password and that person is not available, you might simply have forgotten it. Or you might have been given a machine, or bought one from ebay that has come without a password. Also there have been a few times when a user has looked me in the eye and said “I’m typing my password in, but it’s not working”, I have never seen a password change on it’s own, so I will just put that down to the evil password gremlins.

The procedure will also work on the Windows local administrators password, just bear in mind that his account is disabled by default, (after Windows 8). This procedure will not work if the machine in question has had its hard drive encrypted using BitLocker.

You can use this procedure to blank, (or reset) a Domain Controllers DSRM (Directory Services Restore Mode) password.

You can avoid this procedure if you have access to another account on this machine that has administrative access. If you can log on as an administrator, then you can change the password of other local accounts on the affected machine without the need to do this.

Solution

How to Burn the ISO Disc Image

1. Download the Password Reset CD Image.

2. Download ImgBurn and install, Launch the program, if it does not look like this you need to select View >EX-Mode-Picker. Select the ‘Write image file to disc’ option.

2. The file you downloaded is a zip file that contains the disk image, you will need to extract the image from the zip file (i.e. drag it to your desktop). From within ImgBurn launch the browse option and navigate to the disk image you have just extracted > Open.

3. Select the burn to disc icon (Note: This will be greyed out, until there is a blank CD in the drive). The image is very small, it will not take long to burn.

Carry Out a Windows 8 Password Reset.

This procedure uses the boot CD you have just created, for it to work you need to make sure the machine will attempt to boot to its CD/DVD Drive before it boots to its hard drive. (Or it will simply boot into Windows again). This change in ‘Boot Order’ is carried out in the machines BIOS, how you enter this varies depending on machine vendor, when you first turn on the machine watch for a message that looks like Press {key} to enter Setup. Typically Esc, Del, F1, F2, or F9. When in the BIOS locate the boot order and move the CD/DVD Drive to the top of the list.

1. Boot your machine from your freshly burned CD, when you see this screen simply press {Enter} to boot.

2. Depending on how many disks/partitions you have it will discover them and assign a number to each one, here I only have 1 so I will type ‘1 {Enter}’.

Note: You may see a small 300Mb partition, ignore that. You may also see your machines recovery partition if it has one, if that’s the case you may have to carry out some trial and error to get the right one.

3. The system is set to look for the default registry location C:WindowsSystem32Config so simply press {Enter}. If it fails at this point you selected the wrong drive/partition.

4. We want password reset so select option 1.

5. We will be editing user data and passwords, so again select option 1.

6. You will be presented with a list of the user objects that it can locate, here I want to reset the password for the ‘PeteLong’ user object so simply type in the username you want to edit.

Note: As mentioned you can see here the administrator account is disabled, if you want to work with that account, you will need to unlock and enable it on the next screen before you blank or change the password.

7. You can choose option 2 and type in a new password, but I’m going the blank the password, then change it when I get back into the machine by selecting option 1.

8. To step back you need to enter an exclamation mark.

9. Enter a ‘q’ to quit.

10. To write the changes you have made enter a ‘y’.

11. As long as you are happy, and have no other accounts that need changing, enter ‘n’.

12. Now remove the boot CD, and press Ctrl+Alt+Delete to reboot the machine.

13. As the user object we are dealing with was the last one that has logged on, it will select that account as soon as the computer boots, and now it has a blank password it will automatically log on.

14. To change the password, press Ctrl+I > Change PC settings.

15. Users > Create a password.

16. Type and confirm your new password, and enter a password hint > Next.

17. Log off the account and test the new password.

Cisco ASA – Password Recovery / Reset

Posted on 07/11/2018 by Migrated

KB ID 0000572

Problem

Note: This procedure allows you to reset the password WITHOUT LOSING THE CONFIG

You need to access a Cisco ASA device and do not have the passwords, there can be lots of reasons for this, lack of good documentation, bought a second hand firewall, the last firewall admin never told anyone etc.

This method does require physical access to the ASA, a console cable, and a machine running some terminal emulation software.

Note: This procedure is for Cisco ASA 5500-X and ASA 5500 Firewalls, for Cisco PIX go here, and Cisco Catalyst go here.

Password Recovery ASA5505-X

Password Recovery ASA 5500

Password Recovery / Reset Procedure for ASA 5500-X/5500 Firewalls

Below is a run though on changing the Cisco ASA passwords (setting them to blank then changing them to something else). Basically you boot the ASA to its very basic shell operating system (ROMMON) then force it to reboot without loading its configuration. At this point you can load the config, without having to enter a password, manually change all the passwords, and finally set the ASA to boot properly again.

Below I’ve used both HyperTerminal and Putty to do the same thing, you can use either, or another terminal emulation piece of software, the procedure is the same.

1. Connect to the the ASA via a console cable (settings 9600/8/None/1/None).

2. Reboot the ASA, and as it boots press Esc to interrupt the normal boot sequence and boot to ROMMON mode.

3. Execute the “confreg” command and take a note of the number that’s listed (copy it to notepad to be on the safe side).

4. Answer the questions as follows (Note: Just pressing Enter will supply the default answer). Answer no to all apart from the TWO listed below:

ON AN ASA 5500-X (Slightly Different)

do you wish to change the configuration? y/n [n]: Y <<< THIS ONE
disable “password recovery”? y/n [n]: n
disable “display break prompt”? y/n [n]: n
enable “ignore system configuration”? y/n [n]: Y <<< AND THIS ONE
disable “auto-boot image in disks”? y/n [n]: n
change console baud rate? y/n [n]: n
select specific image in disks to boot? y/n [n]: n

ON AN ASA 5500

Do you wish to change this configuration? y/n [n]: Y <<< THIS ONE
enable boot to ROMMON prompt? y/n [n]:
enable TFTP netboot? y/n [n]:
enable Flash boot? y/n [n]:
select specific Flash image index? y/n [n]:
disable system configuration? y/n [n]: Y <<< AND THIS ONE
go to ROMMON prompt if netboot fails? y/n [n]:
enable passing NVRAM file specs in auto-boot mode? y/n [n]:
disable display of BREAK or ESC key prompt during auto-boot? y/n [n]:

5. You may notice, that the configuration register has changed, on an ASA 5500 to 0x00000040, or on an ASA5505-X to 0x00000041, to boot the firewall execute the “boot” command.

6. This time when the ASA boots it will start with a {blank} enable password, you can load the normal config into memory with a “copy startup-config running-config” command.

7. Now you are in enable mode with the correct config loaded, you can change the passwords, and once completed, change the configuration register setting back with a config-register {paste in the number you saved earlier} command, or simply a no config-register command. Save the changes, (write mem) and reboot the firewall.

Cannot Logon to HP System Management Homepage

Posted on 17/11/2015 by Migrated

KB ID 0000580

Problem

This used to quite common when attempting to contact the HP Management Homepage, (or the local insight manager page) you can no longer get access.

ERROR: Username and password do not match

Solution

With much older versions of the Systems Management Homepage (before it used domain user names and passwords) you could simply copy over the CPQHMMD.DLL file from a server you knew the password for, and then you could get in.

Then they switched to domain authentication, and when that broke you could navigate to C:compaqwbemhomepage, edit the cpqhmmd.ini file with the following entries;

[box]

[HMMDConfiguration]
AnonymousAccess=True
LocalSecurityAccess=true
SleepModeCheck=false

[/box]

Then edit the cpqhmmdx.ini file in the same directory with the following values;

[box]

[HMMDConfiguration]
LocalAccessEnabled=true
LocalAccessType=Administrator

[/box]

Then restart the Server (or the HP Services if that’s easier) and you could log in.

With newer versions of the HP Management Homepage those files no longer exist!

1. Head over to www.hp.com and do a drivers/software search for the model of your server, select the operating system you are using and look in the “Software – System Management” section. Locate, download, and install the HP Management homepage software.

Note: Don’t panic this will not need a reboot.

2. It says Administrators always gets access but I still add it in anyway (Note: If this is a domain controller, the local Administrators group is the domain admins group anyway).

3. Set as follows.

4. I’m leaving mine open from any server.

5. Now we are in! (hooray!) and I’ve got a broken BBWC (boo!).

Cisco Catalyst Password Recovery / Reset

Posted on 17/11/2015 by Migrated

KB ID 0000496

Problem

The title is a bit of a misnomer, we are not going to recover the password, we are simply going to change the password to one we know.

Solution

Note: This procedure works on models, 2900, 2940, 2950, 2955, 3500XL, and 3550. Before you start connect the the device with a console cable and terminal emulation software, the procedure is the same as the one I’ve outlined here.

1. Power the switch off >press and hold the “Mode” button > Power on the switch.

2. For 2900, 3500XL and 3550 Switches release the mode button when the 1x LED light goes out (all the other port lights will remain lit). For a 2940 and 2950 Switch release the mode button after the “Stat” LED goes out. For a 2955 switch press CTRL+BREAK.

3. On screen you should see the following.

[box]

Base ethernet MAC Address: 00:0b:be:78:a2:00
Xmodem file system is available.
The password-recovery mechanism is enabled.

The system has been interrupted prior to initializing the
flash filesystem. The following commands will initialize
the flash filesystem, and finish loading the operating
system software:

flash_init
boot

[/box]

4. Type “flash_init” then when it has ran type “load_helper”

[box]

switch: flash_init
Initializing Flash...
flashfs[0]: 18 files, 3 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 15998976
flashfs[0]: Bytes used: 4386304
flashfs[0]: Bytes available: 11612672
flashfs[0]: flashfs fsck took 17 seconds.
...done Initializing Flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
switch: load_helper

[/box]

5. Next we need to make sure that the config.text file is in flash memory type “dir flash:”

Note: don’t forget the colon on the end or it will error and say “Permission Denied”.

[box]

switch: dir flash:
Directory of flash:/

2 drwx 192 <date> c3550-i9q3l2-mz.121-11.EA1a
17 -rwx 255 <date> info
18 -rwx 255 <date> info.ver
19 -rwx 5448 <date> config.text
20 -rwx 5 <date> private-config.text
21 -rwx 2364 <date> vlan.dat

11612672 bytes available (4386304 bytes used)

[/box]

6. We are now going to change the name of the config file so when the switch boots it will start with no configuration, then we can boot the switch.

[box]

switch: rename flash:config.text flash:config.backup
switch: boot

[/box]

7. Eventually when the switch boots it will ask if you want to configure it, say no.

[box]

Model revision number: G0
Motherboard revision number: A0
Model number: WS-C3550-24-SMI
System serial number: CAT0650Y1VR

--- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: no

[/box]

8. At this point we can go to enable mode, change the name of the config.text file back again, and load it into memory (press Enter to accept the default filenames).

[box]

Switch>enable
Switch#rename flash:config.backup config.text
Destination filename [config.text]?
Switch#copy flash:config.text system:running-config
Destination filename [running-config]?
5448 bytes copied in 0.728 secs

[/box]

9. Finally you can remove the password, and reset it to whatever you want, and save the new config.

[box]

HostName#conf t
Enter configuration commands, one per line. End with CNTL/Z.
HostName(config)#no enable secret
HostName(config)#enable password thisisthenewpassword
HostName#wr mem
Building configuration...
[OK]
HostName#

[/box]

Cisco Router – Password Recovery /Bypass

Posted on 17/11/2015 by Migrated

KB ID 0000931

Problem

If you have a Cisco router that you have forgotten the password for, or have been given one, or simply bought one from ebay, you may not know the password. In fact many years ago an ISP was going to charge me a ridiculas amount of money to put an entry in a routers routing table, this procedure ‘ahem’ would have allowed to to do it myself, for free, and then reload the router.

Solution

The reason you are able to do this is because of the router’s configuration register, this is the setting that decides how the system boots and how it operates. Usually it’s set to 0x2102 you can see this on a working router by running a ‘show version‘ command.

There are a number of different config register settings;

Configuration Register	Router Behavior
0x102	Ignores break, 9600 console baud
0x1202	1200 baud rate
0x2101	Boots into bootstrap, ignores break, Boots into ROM if initial boot fails, 9600 console baud rate
0x2102	Ignores break, Boots into ROM if initial boot fails, 9600 console baud rate default value for most platforms
0x2120	Boots into ROMmon, 19200 console speed
0x2122	Ignores break, Boots into ROM if initial boot fails, 19200 console baud rate
0x2124	NetBoot, Ignores break, Boots into ROM if initial boot fails, 19200 console speed
0x2142	Ignores break ,Boots into ROM if initial boot fails, 9600 console baud rate, Ignores the contents of Non-Volatile RAM (NVRAM) (ignores configuration)
0x2902	Ignores break, Boots into ROM if initial boot fails, 4800 console baud rate
0x2922	Ignores break, Boots into ROM if initial boot fails, 38400 console baud rate
0x3122	Ignores break, Boots into ROM if initial boot fails, 57600 console baud rate
0x3902	Ignores break, Boots into ROM if initial boot fails, 2400 console baud rate
0x3922	Ignores break, Boots into ROM if initial boot fails, 115200 console baud rate

The one we are interested in I’ve emboldened above (0x2142), if we can boot the router, without loading the config, we can manually load the config whilst we have administrative access, which means we can do what we like, (including changing the passwords).

1. Connect a console cable to the router and connect to it using some terminal emulation software (like PuTTy)*. Power cycle the router and as it starts to boot press the ‘break’ key (on some keyboards press Ctrl+Break, on others you can simply press the Esc Key. You will know you are successful if the router boots into ROMMON mode. Issue the following commands;

[box]

rommon 1 > confreg 0x2142
rommon 2 > reset

[/box]

*Typically at Baud 9600, 8 bits, 1 Stop Bit, No parity, No flow control.

2. The router will reboot, when prompted select no to not enter the setup dialog. (Don’t panic your config is safe in NVRAM!).

3. Now you can go to enable mode without entering a password, and load the routers startup-configuration into memory.

[box]

Router> enable
Router# copy startup-conig running-config
Destination filename [running-config]? {Enter}

[/box]

4. You can at this point make any changes you like, but we are here to change the passwords. On this router I want to reset the enable password, and I protect console access with a username and password, so I want to add a new one for myself. Set the configuration register back to its default setting of 0x2101, save the changes. Then reload the router and make sure you can now get access.

[box]

Petes-Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.

Petes-Router(config)# enable secret P@ssword123
Petes-Router(config)# username petelong privilege 15 password P@ssword123
Petes-Router(config)# config-register 0x2102
Petes-Router(config)# end
Petes-Router# write memory
Petes-Router# reload
Proceed with reload? [confirm] {Enter}

[/box]

5. And we are in.

PeteNetLive

Technology that 'Just Works'

Tag Archives: password recovery

Windows – Lost / Forgotten Password?

Problem

Solution

How to Burn the ISO Disc Image

Carry Out a Windows 8 Password Reset.

Related Articles, References, Credits, or External Links

Cisco ASA – Password Recovery / Reset

Problem

Password Recovery ASA5505-X

Password Recovery ASA 5500

Password Recovery / Reset Procedure for ASA 5500-X/5500 Firewalls

Related Articles, References, Credits, or External Links

Cisco Catalyst Password Recovery / Reset

Problem

Solution

Related Articles, References, Credits, or External Links

Cisco Router – Password Recovery /Bypass

Problem

Solution

Related Articles, References, Credits, or External Links