all users disabled !

[scratchONtheBOX]

Hi Beee,

Sorry for late reply. About the OFF TOPIC THING... I had sent you a private message about it. If you are not satisfied with my answer there, I could also send you the full header for the transmission.

And to Sir David Smith of SiteMeter.com (if ever you could read this thank you message), thanks again for your permission and best regards. BTW, I appreciate the services you offer.

Yo!

[LarrySmith]

If they have the recovery console installed during XP setup they can run it and get access to the admin account(I think)
They have instructions on this page on how to use it for Home or Pro
http://www.winxpfix.com/page18.htm

[scratchONtheBOX]

Successful in XP Pro with FAT32 System

ORIGINALLY FOUND HERE - http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html
That was all. The disk fixup is only run on NTFS filesystems, and will force chkdsk next time windows boots.

- Successful in FAT32 System (since my 2nd partition is FAT32)

i use "Offline NT Password & Registry Editor, Bootdisk / CD" which can be found Here
not only will it reset the password but it will also enable a disabled account.

- I have tested it in a test partition and it is PERFECTLY WORKING! Here a quick testing I have done for my BoX:

For the benefit of Beee’s point (about disabling all ACCOUNTS_including_current_user), I can admit that it really works (sorry guys), but still it doesn’t mean that a WELL-AWARE user should disable all accounts for any good reason than testing solutions like this, OK Beee? OK.

- I install an XP Pro in my 2nd partition (FAT32), done the basics, and DISABLED all accounts, restarted and found out the dillema about the “Account is Lock” state on all accounts (of course, we disable it all).
- Try to work around with Safe Mode, Admin Mode, all modes.Although the Recovery Console that came up with the ORIGINAL Win XP Cd I think could do something, but I skip it and go on try another solution.
- Going back to Tedob1’s excellent suggestion, I downloaded the Bootdisk app and followed the procedure. Created a Bootdisk and go on smoothly from booting to re-enabling administrator account. Restarted and here we go. Admin account was reset and the BoX restarted normally. Go to the accounts settings, enable other accounts, and create STRONG PW for admin.

It proved what?

A) Beee’s point (about disabling all ACCOUNTS_including_current_user) is TRUE.
B) Tedob1’s excellent suggestion WORKS in solving such issue.

Now, here I am, kissing the Floppy for a job well done

Simply, end of story.

Cheers and Peace!

Yo!

[beee]

first 10x for testing the solution and putting an end to this conv that started to get bit :S
and sorry about my comment abut the picture in ur signature, it is that i couldn't help myself making the comment... i sometime surprise myself... how could i trace the pic back to the site
by the way.... i registred to it...after ur comment abut it :P

than testing solutions like this, OK Beee? OK

but if i don't test anything how can i learn?

cheerz... bye

[MrLinus]

I'm bringing this up because of some events today in my wargames labs. One of my students who had been having problems logging in attempted to recover with the NT Offline Password floppy. Didn't work. As it turned out, Guest was still enabled (thankfully!) and when we got in I decided to check to see what the admin account had been renamed to (although the floppy kept saying that administrator was the account name for the 500 SID).

I looked in users. No administrator.

I look in groups, under Administrators. One account: administrator.

From what I can tell, the account was deleted from the users but not from groups itself. I didn't get a chance to do forensics and I'm going to ask the student not to erase the disk because there is an opportunity to learn and figure out what happened. No one is claiming credit for it (rather creative for a remote attack).

I am curious if anyone has suggestions as to where the account is.