Windows Forum

Ask something
Discussion Locked

Account locked out

0 helpful
15 replies

by Member 35711908

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
A client has an NT4 firewall, not part of the domain, with two known accounts: administrator and fwalladmin. No one can find the password for the administrator account, but they know the password for fwalladmin. Problem is, the fwalladmin account has been locked out, and after several days and reboots, the account remains locked. They're on the verge of wiping the machine and having us rebuild it. Anyone have any other suggestions? Is there any way to get into the machine and unlock this account?

15 replies

by radiic

Did you happen to make a recovery disk with the rdisk /s that puts a copy of the sam database on the diskette. Well if you were lucky enough to do that, you can download a free copy of lophtcrack and run it against the sam database. It usually does a pretty good job.

www.l0pht.com is redirected now to some research company that i think bought them. I have version 2.5 zipped up and would be happy to email it to you if you want. Its just under 1mg big.

Let me know
Rad

by rorycarlin

Try l0phtcrack from www.l0pht.com. It can run a brute force password crack on a copy of the SAM registry found in c:\winnt\system32\config\sam. You'll need to copy this SAM file on to another machine to run l0phtcrack on it.

You'll need to bootthe locked out machine with a DOS boot disk and copy the SAM on to it. If the system partition is NTFS then you'll also need to run NTFSDOS (available from www.sysinternals.com) to let you read and copy the file after booting to DOS.

Hope this helps.

by syscokid

If you copy and paste that URL in your browser, make sure there are no spaces in it. TechRepublic has a tendency to embed spaces where none belong.

by joseph moore

I love this question!
Ok, the solution I always suggest (since I have used it and it works!) is to do a 2nd NT install on this same machine, so you can modify LOGON.SCR. This is the default screen saver that kicks (with the bouncing "Press CTRL+ALT+DEL to log in" message).
If you change this file with CMD.EXE, then let the machine sit idle, not logged in, for 15 minutes, a DOS Command Shell will start. The shell runs under the Local System account, which has Admin rights!
You can then open User Manager from the shell, and change the Admin password to whatever you want it to be.
YOu are then in!
Here is a link that explains what to do:
http://is-it-true.org/nt/atips/atips262.shtml
(please remove any spaces).
Go 2/3 of the way down the page and you will see all of the steps to follow.

Hope this helps.

This discussion is closed to new replies.