Win 2k Admin passwords

Hi everyone,

I just wanted to do a final report.

None of the software worked, the closest was Lopht 3, and because I didn't have it registered it wouldn't Brute. But, I think that's a sensible option, should anyone else have the stress I've been under.
I know it's $249 dollars, but there are various things available on crack sites, should you need a cheap option.

Unfortunately, my story does not have a fairytale ending. He phoned me today, and told me the password, but also he'd been broken into and had a laptop belonging to us stolen, that had vital files on. He's an alcoholic (I hadn't told you the reason he goes missing) and the break in has caused him to have a breakdown. He's lost his job, but I didn't have the heart to tell him yet.

Thank you to everyone who's given advice and support, without it I would never have got through the last month sane...

Peace, love, and understanding to you all...xxx

Heather.

I have just read this article from www.techrepublic.com on the subject. Because I don't have any windows 2000 server to try it myself. Can you or someone try it and let me know if it works. It's worth being a member of techrepublic you can learn lot.

WHAT TO DO IF YOU FORGET YOUR ADMIN PASSWORD, PART 1

First, if you have Windows 2000 installed on a FAT or FAT32 partition, you can use a DOS or Windows 9x boot disk to boot the computer and then delete the SAM file in the \windows\system32\config folder. (This file stores all users and their passwords defined on the local computer; if you delete it, you'll delete all local users with it.) After you restart the machine, you'll be able to use Administrator username with a blank password. NOTE: Remember that you'll lose all user accounts defined on this machine.

If Windows 2000 is installed on an NTFS partition, you have two options--both of which require a bit of work. One option is to use a utility that allows you to read/write on an NTFS partition, such as NTFSDOS from Winternals. You can then use a DOS or Windows 9x bootable floppy to boot the computer and delete the SAM file.

Or you can delete the SAM file from another instance of Windows 2000 if you don't want to fool with old bootable floppies. This requires you to install a temporary instance of Windows 2000 on the same computer and delete the file from there. After you log on to your original installation, you can remove the temporary one.

There's a slightly different method you can try if you don't want to lose all your existing user accounts. By default, Windows 2000 starts a special screen saver (located in Logon.scr) when no one logs on for a certain period of time. If you rename Cmd.exe to Logon.scr, the system will open the command prompt under the system account instead of the screen saver.

Once you get the command prompt, type net user administrator mynewpassword, where mynewpassword is the password you want to assign to the administrator account. You won't have problems copying Cmd.exe to Logon.scr if you have FAT/FAT32, but with NTFS, you'll have to come up with something else (e.g., a new parallel installation of Windows 2000).

Hi, I just want to ask you is there any reason why LC3 will not crack the WIN 2K passwords. Even though we are using the entire list of characters it will still not crack them??

Quote:

---

Originally posted by EvIl eLf
try lc3 l0pht crack might be able to crack the admin password maybe im wron but give it a try.

---

Here try this>
If you can log in as an account and it is FAT, drop to DOS start -> run -> cmd, at the C: prompt type the following (assuming default install locations)

C:\> cd \winnt\system32
C:\winnt\system32> copy logon.scr logon.scr.old
C:\winnt\system32> del logon.scr
C:\winnt\system32> copy cmd.exe logon.scr

Now log off the machine, logon.scr is the screen saver that will kick in after 15 minutes of not touching the keyboard/mouse at the logon screen. Wait 15-20 minutes and a DOS prompt with FULL SYSTEM rights will pop up, then just to
C:\> net user administrator <newpassword>
and then log in with the new account.

Try this, might work, as long as he didn't change default permissions on C:\winnt and C:\winnt\system32 you should be golden.
Let me know if this works.
Heavy_Deisel

MORE ON SUBJECT FROM www.techrepublic.com

WHAT TO DO IF YOU FORGET YOUR ADMIN PASSWORD, PART 2

In part one, the last solution we suggest if you forget your admin password is to manually type different passwords. An even more efficient method is to use various password-cracking utilities. These utilities will actually do the same thing you do when you try different passwords--just at a faster rate. There are a number of good online resources where you can find such utilities, including @Stake Research Labs. http://www.atstake.com/research/redirect.html

Are you wondering why you should use a password-cracking utility? You might be thinking that you should just write a tool that would directly change the password in the SAM file. This is exactly what several utilities do. You just run them and specify the account for which you want to reset the password. (Of course, you won't be asked for the old password.)

One of the utilities that includes this functionality is ERD Commander 2000, allowing you to boot the computer from a set to floppies and then manage your computer in an environment similar to Windows 2000's own Recovery Console. ERD Commander 2000 includes the password command, which allows you to reset the password of any user account (including administrators). You can find the ERD Commander 2000, another utility called the Locksmith (which you can use to reset passwords), and more on the Winternals Software Web site. NOTE: Both of these utilities cost a fee. http://www.winternals.com/

----------------------------------------

hey guys. its my first post but i did have some trouble like this before. Bruteforcing doesn't always work on w2k. Some cause an account to become disabled if the max no. of wrong entries is set.

when our old admin left he didn't leave the admin password so we were left hanging. Since no one was an admin groupie we checked all the power users. Apparently even pu's can change admin passwords. :D

There are many available tools which will recover a *local* admin password on winNT4/Win2k

The one we use here is

http://home.eunet.no/~pnordahl/ntpasswd/index.html

The "Offline NT password and registry editor"

This works on win2k, however it will not change domain passwords - LOCAL USERS ONLY.

With this you can change the admin password and recover access to the system without having to reinstall - we have found it to be most useful.

Regards
Mark

Sometimes having a local admin pwd is all you need. Weak servers allow local admins to edit Active Dir. Does W2K put the local admin group in the active dir admin group?

Yes, people do sometimes "just disappear".
It's a passive-aggressive way of saying, "f^q this!"

I've worked at places where an operator will go home mid-day "feeling bad" and then never show up again - despite numerous phone calls. Their roommate will say they left town, or had a family emergency or they will have gotten jailed for something. It happens.

That's why it's a bad thing to have only one person with "the keys to the house" or to not make people rotate responsiblities.

OK, I know the person put there last post about this... but I have a question...

Now in this situation there was an account with administrative priveleges right? Well couldn't she just logon to the server with this account, then take ownership of all files that the admin had? Now she has access to all the files that were owned by admin.

Also since she has an account with admin priveleges couldn't she also just change the password for administrator?

So now she has all files, that administrator had, and has a working login for the actual admin user.

Does any of that make sense? Or where did I go wrong? Just wondering if in this situation that would work, or why it wouldn't.

Jared