administrator password

If you do want to brute force the password to see what it was set to, then you must obtain a copy of the system's SAM database and use a tool such as L0phtcrack to brute force crack the password. To get a copy of the SAM database, use NTFSDOS or a Linux boot disk with NTFS drivers on it. Either of those tool will allow you to boot a system from floppy and then read the installed NTFS partitions. You can find NTFSDOS at Winternals while Linux boot disks are available at various sites such as Ken Pfiel's NT Toolbox Web site.

But if you've got access to the SAM database, then why not just reset the Administrator password to something known and be done with it? In that scenario, you can use NT Locksmith, also available at the Winternals Web site. Of course Locksmith costs money, so if you must have a cost-free way out of password recovery, then use a Linux boot disk that comes with a tool that can perform that action.

The Linux boot disk available for download at The NT Toolbox comes with the ability to reset an NT system's Administrator password, and its completely free of charge. Of course you get what you pay for, so don't expect a ton of documentation and an experience professional waiting for you to call for help. When it comes to support you'll have to wing it. But don't worry, using the boot disk to reset a password is much easier and quicker than re-installing NT, so it's worth any problems you may encounter.

I think every security administrator should have a copy of a Linux boot disk like the one at NT Toolbox. Be sure to download a copy, and don't forget to have a floppy disk available. Once you download the zip file, just unzip it and run the included executable file to create the actual floppy-based boot disk. While you're at The NT Toolbox be sure to check out the other great security-related tools available for download.

You can also do it without buying anything. This was published on TechRepublic last week under the title, 'using the system account to your advantage'.

Just log onto the server using any known username & password. Then rename the spoolss.exe to spoolss.bak (this is the spooler service for printing, it runs with system rights). Then rename usrmgr.exe to spoolss.exe (this is the user manager program). Reboot the server and you'll have full rights to user manager (it should start automatically). Change the admin password, rename the files back to what they were, reboot and you're done.

Don

You didn't state what operating system.

Try http://home.eunet.no/~pnordahl/ntpasswd/
or http://www.epinions.com/book-review-65B4-11C49867-39925901-prod4

For NT4, get access to the drive by hooking it to a good system or NTFSDOS, then goto \%Windows%\System32
ren logon.scr login.bak
copy cmd.exe logon.scr

Then hook back up and boot. Just wait for the screensaver to come up. It will be the command line prompt and you'll have access to the computer. Full access! You can run the user manager, create a new account and give it admin privileges or just change the admin password...

I don't think you tried my links. They work on XP.
Also see this link:
http://www.petri.co.il/forgot_administrator_password.htm

OOPS! I typed in 'server', just substitute 'pc' on my previous answer. It will work and it only takes a couple of reboots, no cash.

Don