Printable View
Failte - hey there. I have replaced a former network admin and they locked a whole load of stuff down and regretably did not leave a lot of info behind. So I have a system running Win 2k and it has a general user account that I can use - but it has no admin ability. What I need to do is to recover the user name and password so I can reclaim the machine. Any ideas? Thanks ...
Sure, since you are the new admin, and have access to the boxes, you can use the ntoffline password recovery tool.
http://home.eunet.no/~pnordahl/ntpasswd/
boot to is and use it to change the admin password.
Make sure you RTFM before using though....
Hopefully they haven't changed the boot process and password protected the bios though, cause then you'll need to reset the password on that too.
I have an idea that it probably sucks to be you.... :D
But giving you the benifit of the doubt (just once),I'll refer you to the search feature on AO's main page... you should find a bunch of threads on how that type of question usually gets dealt with around here. If you need help, try typing in "hacking yahoo"..that should help.
After that, you may be inclined to read the site faqs...that will show you what type of questions are acceptable.
If all else fails, search google...you should be 'able' to find something.
And if you are lucky, someone here may take pity and help you out.
Welcome to AO.
groovicus, since offline NT password recovery only works on systems that you have physical access to, I don't see the problem with either the question or the answer. Also, irishhelpdesk, definitely RTFM before you use it. I've heard that people have had data corrupted while using this program.
Cheers,
cgkanchi
Thank you for that explanation.. that clears it up a bunch. But, me being me, what if it is a student looking to get into an instructors box?
Also, there was a case recently of computers being stolen from Wells Fargo..
Or maybe I am just being overly paranoid?
Cheers
Are you sure the password isn't around someplace? It is good practice to have it in a sealed envelope and stored in a safe somewhare on the site.
This is in case the admin gets run over by a bus or taken seriously ill, or whatever
Cheers
Thank you for the suggestion on the boot disk option, I have a copy of that but it is fried for some reason. So your help folks has been appreciated. I can now get this system back into the fold.
Really wish this was a linux network!
I don't know if this is possible or not but you can install cain it dumps the default admin account password in plain text from the LSA file.
I can appreciate that comment nihil, as a matter of fact the head of the comapny knows the master password on the systems I set up. I asked if he would safe guard it in case of the horrible happening ... as far as me being s tudent trying to get the details to hack an instructor machine - gosh good secnario but not in this case. Thanks once again for the help - problem is noew resolved.
Quote:
Originally posted here by Info Tech Geek
My friend says the NT Password and Registry Editor Boot disk will work on ME. I have only used it on NT/2K so... I can't agree with him for sure, but it won't do any damage if you follow the directions.
Quote:
Originally posted here by Info Tech Geek
Under most NTFS file systems the NT Password and Registry Editor Boot disk has been known to work. We use it on NT/2000 and it has never failed. I'm sharing this information in hopes it is used for good reasons only. Don't make me regret this. It can be found by doing a search on google.
Quote:
Originally posted here by Info Tech Geek
I don't like to get into cracking passwords, but I know the NT Password and Registry Editor Boot Disk is a great utility to change the password if you forgot it. It works great on NT & 2K and very easy to use.
Google Search: NT Password and Registry Editor Boot Disk
thats the same thing I posted, in which case, there is no need to google for it?Quote:
Originally posted here by Info Tech Geek
I uses the NT Password & Registry Editor Bootdisk... Look for it.. (Google)
at least... google gives me the same site... two different names for it?
I am starting to think I am an idito here as I have tried a variation of the ntoffline (EBCD) as well as the ntoffline and I am getting nowhere. With the ntoffline I can't get the image to work right and the EBCD I can get it to go through the motions of selecting and changing and confirming and such, yet when I use the password it never works.
Have bee trying to use the Windows 2000 recovery disk (3) and that is not going anywhere either lol. Any suggestions perhaps ...
Ok, download Cain and put it on a computer you have admin privalages on. Thenb log on to the work computer and go to DOS and go to the winnt directory and type "copy *.pwl A:" . Then bring the disk to the computer with Cain and crack them.
slick
*.pwl???
Last time I checked, Win2K still used the SAM. Has there been any consideration that perhaps its an ADS issue?
Offline NT Password & Recovery (version that is up-to-date)
Dealing with Domain Controllers Password
Oops, forgot it was win2k. AFAIK, he still can use cain to crack SAM's.
slick
You are referring to Cain & Abel, the remote password cracker/sniffer?
There is another tool (that costs unfortunately now). That would be L0phtCrack or LC4, which is THE premiere (IMHO) Windows cracking tool. (Not cheap either: $350USD)
I would agree with Msmittens LophtCrack is a very good tool. I have used it fairly often to audit user passwords on our windows Network. True it is a bit expensive but from an enterprise point of view it is well worth the price.
Here are some which may be usefull to answer:
Is there any way to contact the old network administrator. I dont know the history behind the change but if he left the company on good terms there should be no problem getting all the passwords off him. On the other hand if he left on bad terms you have a potential security time bomb on your hands. I am not trying to sound alarmist but if you are the new network Administrator it is something you should be thinking about, even if it is just from a professional point of view.
how did they lock down the system.Quote:
I have replaced a former network admin and they locked a whole load of stuff down and regretably did not leave a lot of info behind. So I have a system running Win 2k and it has a general user account that I can use - but it has no admin ability.
1) Does this mean that the computer is not in a domain and it is locked down using local security permissions?
2) That it is in a domain but the domain admin is not a member of the local administration group?
3) That it is in a domain but you have not got pass word for the domain administration account?
Another question i would ask is what is the setup of your (mainly because i like to have some idea of the system i am trying to fault find on).? Is the box a windows 2K server or workstation. This has no real impact on your problem. Is the computer attached to a domain or is it independant. This is fairly important as if the machine is part of a domain it brings up a whole lot of other possiable problems (AD, domain GPO's, ect).
Sorry about the long winded reply (i also have the gift of the gab) but i think if you could answer some of these points it would help in solving the problem.
In anycase good luck in your new position.
As I was reading all these suggestions on how to go about your issue, i kept wondering why no1 has mentioned @stake's L0phtcrack, until Mittens got it :). I own an older version of the l0pht and I can by personal experience, strongly recommend it. Being an Admin, you should have the firm you work for invest into buying a license because it will help you significantly in the future. I've made an habit of myself to carry a bunch of network tools with me wherever I go, including Spybot S&D, Ad-Aware, AAA Tools *http://www.glocksoft.com*, l0pht, and about a dozen scanners, sniffers, and whatnot. These were easily carried in a USB flashmedia in my keychain, always ready to be used. I would recommend this habit to ANY system administrator to put your most used/important/emergency tools like that. I had a deal with the SYS admin @ the Bank that I worked for to help him out everytime his system was hit by something he couldn't handle. I just like to fix things :)
Good Luck.
Does the server run Active Directory? You may be in for some additional work if so. :)
-Maestr0
(Is it a server?)
im not an expert or anything, but i had luck booting to a knoppix cd.. pulling the sam to a disk.. run an afs remover and throw it through john ... but thats just me.
Maestr0, not necessarily. In post #14 the 2nd link provides instruction on how to deal with ADS (and it's amazingly simple -- took me 1 min in an experiment at work with a colleague who didn't believe it was that simple.. boy, did he get a shock)Quote:
Does the server run Active Directory? You may be in for some additional work if so.