Printable View
How?Quote:
But a smart admin will make it very difficult, a very smart admin will be able to track when and where such an attempt was made.
BTW elfguy, the SAM file is used by Windows so it can't be copied whilst in Windows, even if you log on as the (super/built-in) Administrator.
Yes, reformat and reinstall Windows. You really have no logical alternative as the machines have been owned for God knows how long by someone with administrator rights. You have absolutely no idea of what "goodies" they may have installed.Quote:
can anyone help me out here?????
There is no other sensible way of going about it, as it is the administrators account that has been compromised.
When you have done this, please advise your Systems Administrators that they need to review their security policies, and lock down their systems. The secret is in minimalisation; groups of users should only have the authority to do exactly what they need to, and no more, no matter how convenient it might be ;)
Incidentally, you should not RESTORE passwords, you should always REPLACE them.
:)
There are tools.....................hey even a simple keylogger would do the trick.Quote:
How?
On the off chance that there is irreplaceable information on the machines that you want to recuperate you can use a linux boot disk to modify the administator password. You should be able to find one easily enought on google. After which i would most definatly redo the machines before i put them back on the network. As Nihil said you never know what other little surprises are left on the machine after someone owned it. :D
if you are using computer that is connected to the domain, then it is possible that passwords is stored on the remote server and not on you computer HD.
if you have admin, then ask him, cuz it is he who desined/administrating network that you are using.