Domain Admin Password Recovery

I recommend ERD Commander 2005 Server version from Winternals (www.winternals.com).
It may be pricey, but you need a tool that guarantees the system integrity after resetting the Administrator?s password.

You cannot change domain passwords using a 'local' user. You need to login with a user with at least Account Operator priviledges to change admin passwords on the domain.

Do you have ANY other users with some sort of priviledges other than 'Administrator'?

Try this method instead:
http://www.petri.co.il/reset_domain_admin_password_in_windows_2000_ad.htm
(if not already done) or this for 2003:

http://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm

Well, looks like you have too options:

1. Wait until the comatose admin awakes and get him to give you the password.

2. Rebuild the domain.

Try L0phtCrack....there is a cost but it will get you the info you need.

http://www.atstake.com/products/lc/

Try this?

Windows XP/2000/NT Key (Enterprise Edition)

It is possible to reset the domain admin password in AD. However since the AD database is separate from the local SAM now this will not work with Windows 2000/2003.
Procedure: You will need the Offline NT Password & Registry Editor to reset the local admin password on the DC. After that follow these steps.

Reset local administrator account password
Reboot machine and hit F8 for Directory Restore Mode. The machine will boot without starting AD.
Logon as administrator. You only have local admin rights which will not let you modify AD, but will let you modify the system.
Run regedit. Navigate to HKEY_USERS\.Default\Control Panel\Desktop
Change the following key values:
SCRNSAVE.EXE ? change value to cmd.exe
ScreenSaveTimeout - change value to 15 (Time in seconds to display screensaver)
ScreenSaveActive - change value to 1
Reboot the server and when the logon screen comes up wait. A command prompt will be displayed after 15 seconds
Type MMC DSA.MSC which should launch (this file should be located in the C:\%systemroot%\System32 directory. %systemroot% will be WINNT or Windows depending on whether an upgrade was performed.)
The AD Users and Computers snap-in Launches where you can change the password. Warning: If the account has any files encrypted using EFS, these files will be unreadable after changing the password.
Logout, and logon with the domain administrator account. Undo the changes made in step 4.

Use Offline NT Password & Registry Editor disk to reset MACHINE Administrator password to "no password".

Reboot, F8, enter "Dir.Service Recovery Mode". machine will boot up as standalone server without Active Directory support.

Question: If you can reset the local admin account password, why can't you remove the restriction that the previous admin placed on the local admin account of not being able to change domain user details & passwords? If he placed that restriction on the local admin account and you can only login as the local admin account, it seems like you're at a dead end unless you can use a tool like ERD 2005 or something similar.

Resetting Domain Admin account password:
When the login screen appears, hit CTRL-ALT-DEL and log in as "Administrator" with no password. This is the MACHINE Administrator account, and does not have the ability to modify anything specific involving the Active Directory information, although it can backup and restore the physical files which contain the AD databases.

Run "REGEDIT.EXE" (without the quotes). Navigate to HKEY_USERS\.Default\Control Panel\Desktop

note: Make sure you write down the default values BEFORE changing them or just PRINT SCREEN your regeditor display or just backup values to a .REG file by selecting the DESKTOP key and then selecting EXPORT from the FILE menu.

After you're sure you know the default values are, change the following:

SCRNSAVE.EXE - change from logon.scr to cmd.exe
ScreenSaveTimeout - change from 900 to 15
ScreenSaveActive - change to 1 (if it wasn't 1 already)

continued on next post:

continued from last post:
Reboot normally, When the box appears asking you to hit CTRL-ALT-DEL to log in, just wait.
After 15-30 seconds you will see a command prompt appear (since that is the screensaver).
In the command prompt, type the following command:
MMC DSA.MSC
note: There is a space character between the "mmc" and the "dsa.msc". Also, note that the DSA.MSC file is usually located in the SYSTEM32 subfolder of your WINDOWS or WINNT folder.
More notes: DSA.MSC is actually the executable name for Active Directory Users and Computers, which in turn is the main tool for managing users, groups and computers in Windows 2000 Active Directory.
This should bring up the management console where you can edit users' passwords, including the password for the Administrator account.
After resetting the Administrator password, exit the management console and type the command EXIT in the command prompt window.

Hit CTRL-ALT-DEL and log into the DOMAIN Administrator account using the new password!

Don't forget to undo the changes you made to the registry (see step #4), or you will always have a command prompt with Domain Administrator rights appear whenever somebody logs out.

More info:

http://www.lostpassword.com/windows-xp-2000-nt.htm

Windows XP/2000/NT Key is a program to reset Windows 2003/XP/2000/NT security if Administrator password, secure boot password or key disk is lost.

Features

Resets passwords directly from a bootable USB Drive, no floppy or CD-ROM drive required New!
Resets password for any account New!
Resets local policy settings for any account New!
Windows 2000 Professional, Server and Advanced Server are supported
Resets Domain Administrator password for Active Directory Domain Controllers (Enterprise Edition only)
All secure boot options are supported
All Service Packs are supported