locked windows XP..

greets everyone...

here is a li'l problem one of mt frens is facing...

he uses winXP pro and used to login thrugh the admin account only.. now recently... his cousin cam to see them .. and was quiet addicted to the p.c. (he also used the same account) but this friend of mine dint like it.. and created a separate guest account for him.. but this cousin bro was one step ahead .. he logged in through the admin account and changed the password and went off to his native... now .. my friend is stuck up.. as he has just the guest account to have an access.. and cant do anythign about the admin privilages..

i tried to google also.. but all i could know was tht only if i have the rescue disks made frm tht p.c. .. i can change the admin password....other wise i can use the default admin account which is made during installation.. but the worst part .. is the same account is locked...

i hope to get a solution here....i myself use winXP Pro and tried to look for all kinds of password files and Sam files on my system...but no use...

please help.. and take my word for it.. im NOT TRYING TO HACK INTO ANYONE ELSE'S BOX.

Im not sure, but couldnt you boot up into safe mode and make a Admin account, im not sure if it's possible to create an account in safe mode, never tried it, but it's worth a try.

Offline NT Password and Registry Editor Bootdisk. I'll leave the ethical issues up to you. Enjoy.

Why not format C:/ and just re-install XP, and have the admin account changed? I mean, unless he has anything of value on his PC (he could save that to disc by the way) then formatting wouldn't be a bad idea. Like MemorY, I'm not too sure about what booting in safe mode could do for you because I don't have XP but I assume if you also did that and maybe could access admin from there? Dunno.. does XP have the same system restore that WinMe does? No, right? Because if it did, then you could boot in safe mode and system restore back to a few days earlier than the changing of the password's.

Blah, I think I'm starting to ramble. Answer some of my question's and I'll help you out.

Log in as guest, save important files, format the HDD and reinstall the operating system. Then reload your data.

Create the backup diskettes THIS TIME?

Create a super user account, rename the admin account and keep its password safe.

Make sure that you have a firewall running, and update windows..............helps if you have the free CD from microsoft.

Cheers

you cant change password on safe mode at xp. You still need administrator (or equivalent) password to get access. If it is possible, every user on corporate computers could get access to admin and install garbage.
The only i know (besides re-install) is to use Petter Nordahl-Hagen utility as mencioned before. There is an version that supports XP.
But it is at your own risk, because that tool can damage your disk data (sometimes it happens)

Most offline password changers work well as long as the default location of the passwords was not changed. I always recommend changing the default location of password storage for critical machines as its just one more hurdle if you can't prevent physical access.

Passware is another tool that works well to reset admin account passwords.

Always wished MS would allow a UNIX like single user mode from console to change admin
password if lost or forgotten..

SGS

thanks guys for an early response...

well XP doesnt allow to change passwords in safe mode...and even if system is restored to a earlier point .. the passwords remain the same...i have tried it on my own box...

i have already downloaded the files msmittens has suggested.. i hope those work.. if not, then i always have the other option as u all have mentioned, to format the disk...

Quote:

---

Passware is another tool that works well to reset admin account passwords.

---

Hrmm, where can I get this "Passware" program. I'd like to see it and it's website, etc because that program look's (well, sounds like) as if it could be used the wrong way. For instance, a hacker could easily use it on a school computer or his home computer to get admin privledge's because his mom/teacher/admin set a password. He would use that to make the password reset, so that program seem's like it could be used the wrong way.

Quote:

---

Originally posted here by ss2chef

Always wished MS would allow a UNIX like single user mode from console to change admin
password if lost or forgotten..

SGS

---

I hope they dont listen your wishes.... i :(

Google is always good at finding this stuff

Quote:

---

Always wished MS would allow a UNIX like single user mode from console to change admin
password if lost or forgotten..

---

That becomes a security risk when you think about it. And if MS wants to meet the needs of the US Gov, this may be part of the reason why. In addition, many of the *nix environments are putting passwords on single user mode, so this may become a thing of the past.

Quote:

---

Originally posted here by Spyder32
Hrmm, where can I get this "Passware" program. I'd like to see it and it's website, etc because that program look's (well, sounds like) as if it could be used the wrong way. For instance, a hacker could easily use it on a school computer or his home computer to get admin privledge's because his mom/teacher/admin set a password. He would use that to make the password reset, so that program seem's like it could be used the wrong way.

---

http://www.lostpassword.com/

Yes it can be used for evildoing.

With the good always comes the bad..:)

Well...since the default Administrator password has been compromised, I suggest one of two things:

1) Do the reformat suggested by the above.
2) Preform a good, ol' fashion hack against the box.

The second may seem like a waste of time, but it might be a good learning experience. Boot up into a CD based Linux, copy the SAM file, extract the password hashes, and perform dictionary and, if need be, brute force attacks.

If you decided to format the drive with fat32 during the initial installation, you may be able to get the SAM by just dragging it off the HD while mounted as a secondary drive.

Or, if you feel less adventurous....just copy important files...and reformat...BORING... :D
Another bad thing about this is that you cannot retrieve your old files if they used EFS encryption on the drive. You can't get the old files back unless you get the original password anyway....

Quote:

---

That becomes a security risk when you think about it. And if MS wants to meet the needs of the US Gov, this may be part of the reason why. In addition, many of the *nix environments are putting passwords on single user mode, so this may become a thing of the past.

---

Goes without saying...

the link specified in the earlier post .. explains how to use the tool... and its actually pretty simple.. just like working with a wizard... the possiblity of misuse cant be denied.. but lets hope tht it is used for good only..

The way I look at it, the box has physically been owned...............so you don't know what is or is not on it? It has been owned by a known malicious person?

Quote:

---

Or, if you feel less adventurous....just copy important files...and reformat...BORING...

---

I am afraid that is the standard recommendation in these circumstances from a purely security aspect.

Cheers

I take it that you now can access the admin account? That tool is surprisingly easy and is probably used by both white and black hats. There is another link there on how to deal with the AD server if the password is forgotten. We experimented here at the school and I was showing it to a colleague. We were amazed as to how easy it was to reset the password (without a boot disk) for the AD (took us about 2 min due to reading comprehension issues). Granted you can take a longer method (the linux bootdisk, copy the same and try to find the right hash) but the real world often is a "NOW" concept. Sometimes tools just work better. :D

Quote:

---

The way I look at it, the box has been physically been owned...............so you don't know what is or is not on it? It has been known by a known malicious person?

---

This is an important point to consider. A check of the box for things like viruses, trojans etc. might be worthwhile. While he may have locked out the admin account, it is possible he did more. A reformat will guarantee you catch everything but perhaps it might be worthwhile to see if you can find it without resorting to a reformat just yet.

I would only suggest my option if there were EFS encrypted files that he "needed" to get access to.

Seeing as how these people appear to be nothing more than "learned" users at best, I would assume they do not.

With the good indeed come's the bad, but that Passware program sounded more to me as if it was meant more for malicious intention's. I mean, think of like a program description for it.

Quote:

---

This program reset's the admin's password. 1337 r1gh7??

---

:D

Peter utility will "blank" the password
*nix box nowadays stop that "single user root password reset" because it was really dumbass to do that. You can avoid that

Quote:

---

You still need administrator (or equivalent) password to get access.

---

Well when i boot, there is an option to access an account called "administrator" and under that account are all the account i added manually....And the Admin user account is without a password in safe mode. I ddi try to boot into safe mode at schol just to test the secuirty and how good the teacher secured the computer, and he disabled booting up into safe mode. That answers the queston, that somebody at work could just "boot" up into safe mode and change the password. It is possible to disable safe mode.

Quote:

---

Originally posted here by MemorY
Well when i boot, there is an option to access an account called "administrator" and under that account are all the account i added manually....And the Admin user account is without a password in safe mode. I ddi try to boot into safe mode at schol just to test the secuirty and how good the teacher secured the computer, and he disabled booting up into safe mode. That answers the queston, that somebody at work could just "boot" up into safe mode and change the password. It is possible to disable safe mode.

---

I was going to mention this, but then I re-read the spaghetti-string English post, and found out this account was locked.

Quote:

---

Originally posted here by Spyder32
With the good indeed come's the bad, but that Passware program sounded more to me as if it was meant more for malicious intention's. I mean, think of like a program description for it.

:D

---

An example of the good.

Local not for profit found my company in the phone book and called needing help.
They had a Windows SBS server and used a local college student to admin the box
as needed. The student graduated and moved back home without making any arrangements
to pass on important info like admin passwords. The server was giving problems and needed a looksee. I walked in there blind with no admin account info and some desperate users looking to me for help. Passware allowed me to get their access back in a few minutes saving them a ton of time, trouble, and money they didnt have in the 1st place.

Recovering lost passwords on everything from Access databases to Windows servers is a very common situation. I get several calls per month and am glad I can offer quick help with tools like Passware.

Good example, and I hope it was made clear that I understand it could be used for both good and bad. :)

Any tool is as good as the hand which uses it ...

well as for my problem.. its kindda solved now.. i hope the tool would work... and fellows.. the box is now owned by any hacker,

it was just a password change .. to make the computer out of use.... rest assured is fine...

thanks for help everyone

Quote:

---

Any tool is as good as the hand which uses it ...

---

the difference between an apprentice and the Craftsman..

Memory, i have no idea how do enable that "No password admin safe boot".

On all Windows XP here, you cannot enter (in safe mode) at admin account without a password.

Could you put some details here? I can use this at my home computer..... :)