Windows Forum

Ask something
Discussion Locked

Desperate for Admin Password

0 helpful
7 replies

by mary_ann

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Yesterday, our "computer guy" was let go, and out of spite he must have locked us out of our file server. (He had other functions with the company, but he was pretty much the "go to" guy.) There never was a password, but there is now. And NOBODY KNOWS WHAT IT IS!

We have a small network of 12 computers running Windows 98 and a file server with Windows NT 4.0.

We all have a fair amount of computer knowledge around here, so we can fix most things that come up. We do have a consultant that we've called from time time, but he's out of town and can't get here for a few of days. Another consultant we called (out of the phone book) said he could do it today, but it might cost around $800.00. We'd pay the $800, but I hate to be taken advantage of. And I think he's trying to take advantage of us, but we can't really wait 2-3 days for our regular consultant.

Considering the fact that a few of us around here are pretty computer literate, and we aren't really intimidated by delving into a computer problem, is there any way to recover or remove that Windows NT administrator password.

Thank you,

Mary Ann

7 replies

by maxwell edison

I’ve seen quite a few utilities for this problem, but the best resolution I’ve seen is this one (and I’ve even used it):

If you have lost the Administrator password, you must have the following to recover:

1. A regular user account that can logon locally to your Windows NT Workstation, Server, or PDC whichever you are recovering.
(If you already have an alternate install of NT, skip to The Process, Set 02.)

2. The Windows NT CD-ROM and setup diskettes (winnt /ox tomake them from the CD-ROM).

3. Enough room to install a temporary copy of NT (Workstation will suffice, even to recover on a PDC).

4. Your latest Service Pack. (Preferably SP6)

-------------------

The Process:

1. Install a copy of Windows NT as TEMPNT, on any drive. Install your latest Service Pack.

2. Boot the alternate install.

3. At a command prompt, type AT HH:MM /INTERACTIVE CMD /K where HH:MM is 10 minutes from now (or however much time you need to complete the remaining steps and logon to your primary installation).

4. Use Regedt32 to edit:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Schedule

5. Double click Schedule and click the one sub-key.

6. Double click the Schedule value name in the right hand pane and copy the REG_BINARY string to the clipboard.

7. Select HKEY_LOCAL_MACHINE and Load Hive from the Registry menu.

8. Navigate to your original installation\System32\Config folder and double-click System.

9. At the Key Name prompt, type ORIGSYS.

10. Navigate to ORIGSYS\Select and remember the value of Current; i.e. n.

11. Browse to ORIGSYS\ControlSet00n\Services\Schedule and if Start is not 0x2, set it to 0x2.

12. With Schedule selected, Add Key from the Edit menu.

(continued in next comments..)

by maxwell edison

.
.
13. Type 001 in Key Name and click OK.

14. Select 001 and Add Value name Command as type REG_SZ and set the string to CMD /K.

15. Select 001 and Add Value name Schedule as type REG_BINARY and paste the string from step 6.

16. Select ORIGSYS and Unload Hive from the Registry Menu.

17. Use Conrol Panel / System / Startup... to make your original install the default.

18. At a CMD prompt:
attrib -r -s -h c:\boot.ini
edit c:\boot.ini and either change the id ofthe TEMPNT lines to Maint 4.0 on both entries
if you intend to keep this maintenance install or delete them. attrib +r +s +h c:\boot.ini

19. Shutdown and restart your original install.

20. Logon as your user account and wait for HH:MM from step 3.

21. When the CMD prompt opens, it will be under the context of the Schedule user, either the System account or an administrative account. If this machine is the NOT the PDC, type MUSRMGR.EXE, if it is the PDC, type USRMGR.EXE.
If you get an error, click YES and type your domain name.

22. Set the Administrator password and logoff.

23. Logon as Administrator.

24. If you are deleted the TEMPNT entries in step 18, delete \TEMPNT

Note: If the Schedule service runs under the context of a Domain Administrator on any member workstation, all you need to recover the PDC Administrator is a network login.

Good luck,

Maxwell

by maxwell edison

.
.
It the preceding doesn't work, or you don't feel comfortable implementing it, there are a couple of more options. Cut and paste these links for information on utilities to remove and/or recover lost passwords:

NTAccess:

http://www.mirider.com/ntaccess.html

Another possibility:

(http://is-it-true.org/nt/atips/atips262.shtml

And then there’s this utility:

http://home.eunet.no/~pnordahl/ntpasswd/

(REMOVE SPACES from the pasted URLs.)

Feel free to email me if you have any other questions.

Best of luck,

Maxwell

by shanghai sam

You could install the client tools from your NT4.0 server CD onto a win9x machine NOT NT4 W\S or Win2k this includes user manager for domains

or

I cannot take full credit for this one it has been on TR some time now;
Heres the back door, assuming your boot partiton is fat. boot to dos,
cd\%systemroot%\system32\
ren logon.scr logon2.scr
copy c:\%systemroot%\explorer.exe c:\%systemroot%\system32
cd\%systemroot\system32
ren explorer.exe to logon.scr
reboot computer and wait at logon screen for about 10-15 minutes. logon.scr will launch and you will be at the desktop with system rights. Go into user manager and change Admin password....All this depends on being able to boot to c:....don't forget to change the logon.scr back when your done. Hope this works.... If you partiton is not fat, I think there is a company out there that has ntfs boot disks but I have never used one..

if your boot partition is not FAT the another way to acomplish this is to take out the HDD and put it into another machine running NT4.0 or Win2k AS A SLAVE then you can make the adjustments from there not forgetting that c: will now be d: then put the drive back in your server and wait for the screen saver to kick in. You should only have the server down about 1hr

or

There also these sites
nt locksmith : www.sysinternals.com or winternals.com

or on hacksite:
LoPhtCrack

Hope this helps
Chris

This discussion is closed to new replies.