need Admin account, help!

Hi,

I'm trying to fix a computer for a relative.

The Windows XP Pro he has, has 2 admin accounts (the main and a user member of admin group) and also 1 power user. Main admin account is disabled. Only 2 users to login to at bootup.

Now to the problem. My relative opened up the properties for his account (the user w admin rights) and went to the "Members Of" section, highlighted "Administrators" and , pfff, removed that membership.
Rebooted and ofcourse his account does not show up anymore in the login.

-I've tried creating an admin account thru commands in DOS prompt and Comp Management.
-Tried "Last Known Good ....".
-Tried "Recovery Console" which asks for admin pwd (no go).
-Tried a Repair with the XP CD and that didn't enable the main admin account either.
-Tried Safe Mode with no result.

Does anyone have a solution to this or is it as I've believed all the way that for security purposes the main admin account can't be enabled or a new user admin account be created but with another user with admin rights?

A simple solution or any hacking method much appreciated.

If I understood your problem correctly, do the following:

At the logon-screen (with the 2 users) press CTRL-ALT-DEL twice.
This will pop-up the standard Windows 2kx logon-screen.

Username: Administrator
Password: The_one_you_have_chosen

thx, but guess my post is a bit messy.
Can't do that since there is NO admin account on the machine anymore, except the main one which is disabled :(

so....you cant login what so ever?
or do you have access to a guest account

Are you sure?

If you have a "super user" they are members of the Admin group. You can only set up two sorts of account:

1. Admin
2. Limited

You cannot turn off the Administrator account, you can delete it, but only if there is another account with Admin rights.

The only account you can " turn off" is the default "guest account"

An administrator cannot delete his own account. You must use another account with admin rights.

You must have an admin account still on there...........try the "super user one"

Quote:

---

A simple solution or any hacking method much appreciated.

---

Use the remaining Admin account otherwise format and re-install the OS.

EDIT:

Quote:

---

Can't do that since there is NO admin account on the machine anymore, except the main one which is disabled

---

That is not possible according to Microsoft.................how are you logging into the machine then?.............are you sure it is not the Guest account that is disabled?

Otherwise reformat and reinstall would seem to be your only option.

Got a power user account enabled which I can login with. That account dont allow me to create admin account tho.

http://home.eunet.no/~pnordahl/ntpasswd/

you need pysical access to machine. i use this (or something similar!) quite a few times to reset pwd on forgotten admin acc.

No of course it won't because you already have one which you say is disabled..........by that I suspect you probably mean "corrupted".

In the superuser account, try changing the password on the Admin account.

Otherwise delete the Admin Account and create another..............it won't let you have two the same.

You should be able to run the recovery console from the power user login.............just use that password

Quote:

---

Originally posted here by nihil
You cannot turn off the Administrator account, you can delete it, but only if there is another account with Admin rights.

The only account you can " turn off" is the default "guest account"

An administrator cannot delete his own account. You must use another account with admin rights.

You must have an admin account still on there...........try the "super user one"

---

Yes, the Power User acount (or as u put it Super User) is supposed to be able to create and modify user accounts but I've tried and it won't let me with the message that I dont' have enough rights.

I think your wrong about the Admin account. The main admin account (SID ...xxxxxx-500) can NOT be deleted, ever. It can be renamed and disabled tho, as long as another "user admin" account has been created first.


LOL, what a mess this is. I'm probable reinstalling tomorrow and this time I'm creating a third admin account for ME, just in case he would do same thing or similar thing in the future.

Thx for helping out.

my opinion is get something like: EBCD which can be found here: http://www.petri.co.il/forgot_admini...password.htm#3

Create a cd and pop it in the current computer and reboot. Than you can reset passwords or undisabled/unlock adminstrator accounts.

Hope this helps
~Jonathan

Quote:

---

Originally posted here by nihil
That is not possible according to Microsoft.................how are you logging into the machine then?.............are you sure it is not the Guest account that is disabled?

---

Well, either a change has been done in SP2 or they are simply wrong. Test yoursef. Scary stuff.
Do this:
The SID 500 Admin account, disable it after creating another account w admin rights.
Then reboot and enter with the user with admin rights and go into tha users properties and remove youserlf form ALL memberships and reboot. Voila, ****ed up :)

I can enter with my Power User acount but as stated this account won't let me create any admin account. Other account yes, but not admin account.

Quote:

---

Originally posted here by jbclarkman
my opinion is get something like: EBCD which can be found here: http://www.petri.co.il/forgot_admini...password.htm#3

Create a cd and pop it in the current computer and reboot. Than you can reset passwords or undisabled/unlock adminstrator accounts.

Hope this helps
~Jonathan

---

I have EBCD, WinEBCD, F.I.R.E. and others but I can't find any app on them that can help with enabling the main admin account. Please tell me which app on EBCD that can do this.
I havn't used any of them boot CDs much so I need help which app.

Thx

Well they are not wrong with XP Pro SP1,

It sounds like your system has become corrupted. Why would you want to disable the Main Admin account anyway? I can understand doing that to the guest account and RENAMING the Admin account.

Can you delete the Admin account from Power/Super User? or can you run the recovery console with that password or the original main Admin password?

You seem to have upgraded to SP2................maybe something went wrong when that was happening? It does sound like you have a corruption as you should not be able to disable anything other than the "guest" account.

Otherwise you seem to have discovered a gross design flaw in SP2

It might be worth reporting it to Microsoft.

I am afraid that you may well have to back up your data and re-install :(

Good luck!

Thank you very much Nihil for trying to help me.

Some answers to your questions:

I always disable OR rename the SID 500 admin and create another user admin account to use, for security reasons.

I don't know if it is a corrupted system since I can't see any signs of it and since it's not my computer and don't know every step my uncle has done. But he IS an ordinary user and doesn't know much about comps. Could be that it is somehow corrupted without me being able to see that tho :)

You say "you should not be able to disable anything other than the "guest" account". Sorry, but that's wrong. You CAN disable ALL accounts, as long as there is ONE account left enabled with admin rights.

I've tried using the Power User pwd in Recover Console to no use. Also tried the disabled main admin (the disabled one) pwd and doesn't work either. Gonna get my uncles user admin pwd tomorrow and test with that too. But since his account now is member of NO groups at all, I got no hopes for that either.

The Power User account will not allow me to delete any admin account.

Thx again nihil

Guess I can't be bored ;P

You are welcome, sorry I could not be of more help but I am still at SP1 (one of those potentially problem AMD machines:)) I know that there have been major changes with SP2

Quote:

---

You say "you should not be able to disable anything other than the "guest" account". Sorry, but that's wrong. You CAN disable ALL accounts, as long as there is ONE account left enabled with admin rights.

---

That is exactly how I understood it, and how it works in SP1 except that I only seem to be able to disable "guest" otherwise I have to delete them. Mind you, it is not something I have ever needed to do, so it might be possible. However I suspect that it could be a new feature with SP2? I really don't understand the logic. Surely an account should be available for use, or not there at all?.........I don't think that having disabled accounts with admin rights lying around your system is a good idea from a security viewpoint.

It could lull people into a false sense of security?........supposing a hacker managed to activate one....AH! just like taxis and policemen, there is never one there when you need one.........we could actually use such a hacker right now :D

Like yourself I rename the main Admin account and create another account in the admin group.

I don't think that you would notice if it was corrupted, but the system has allowed a situation to arise where there are NO accounts with admin rights that are enabled. That is either a corruption, or a flaw in SP2. As you say above there should be ONE left?

Good luck

Quote:

---

Originally posted here by -=Wayuu=-
I have EBCD, WinEBCD, F.I.R.E. and others but I can't find any app on them that can help with enabling the main admin account. Please tell me which app on EBCD that can do this.
I havn't used any of them boot CDs much so I need help which app.

Thx

---

I believe if you load the EBCD bootable CD and than use option 4 or 5. This should ask if you want to reset a password or access files on the computer. Once in this mode(actually linux) you should select the hard drive to mount(normally the correct defaults are in brackets and you can just press enter) and than it will ask if your going to reset a password and you can select yes. It will ask for an account, and than tell you what the account settings are: "locked, disabled, password never expires" and will ask if you want to reset all atributes to false. say yes to this, and than reset the password to my favorite "*" which should reset the password to a blank password. However in the very end it will ask if you want to write the file to disk. Make sure to select NO. The passwords will still get reset and the account changed, however I recently used this on my windows 2000 sp4 machine and when I selected Yes, i loaded windows only to find my admin account has disapeared and an error when loading local users and groups saying it was corrupt.

Let me know if you need more help

OK as u r about to reinstall the windows try using this i m sure this will work. Its working 100% in windows 2000

Log into windows with any account no matter if it doesnot have privillages of Administrator or not.

Now goto run and type "regedit" and enter if its not working try "Regedt32".

A window will popup and u will see some main headings on left hand side. Now scroll for the following entry.

HKEY_USERS\. DEFAULT\Control Panel

here u will see an entry on left "DESKTOP" single click on it and this will show u some entries on right hand side.

FInd the following entries and chage there values to what i have written: -

SCRNSAVE.EXE

click and open it and assign it the complete path of your command prompt. for example c:\cmd.exe or whtever is urs.

ScreenSaveTimeOut

THis is the timeout for the screensaver. its in seconds so assign it value say suppose 2 .


ScreenSaveActive
Sets its value to 1

ScreenSaverIsSecure
set the value to 0

Now close the registry press F5 and restart your computer.
At the login page wheru hit Alt+Ctrl+Del dont do anything just wait, after the timeout value that you have entered command prompt will run.

Now comes the last part do this: -

when the command prompt appear write the following command
c:>net admin yournewpassword

now u can login with the main administrator account with the new password.

Fanacool. Thx, but not working.

I loged in as a Power User and tried editing reg. but when trying to edit a key I get error saying that key "can't be edited. An error occured while writing the new value" (not exact message since I translated it from my language).

Too bad cause this trick looked great.

I can edit Hkey_Current_User, but not Hkey_Users :(

Just to close this one :)

-=Wayuu=- figured it out...............

Like most of us, he uses Windows English version, his uncle uses the Swedish one!

"administrator" has a slightly different spelling in Swedish :o

Obviously, if you don't spell the account name correctly...........................

:D

Quote:

---

Originally posted here by jbclarkman
I believe if you load the EBCD bootable CD and than use option 4 or 5. This should ask if you want to reset a password or access files on the computer. Once in this mode(actually linux) you should select the hard drive to mount(normally the correct defaults are in brackets and you can just press enter) and than it will ask if your going to reset a password and you can select yes. It will ask for an account, and than tell you what the account settings are: "locked, disabled, password never expires" and will ask if you want to reset all atributes to false. say yes to this, and than reset the password to my favorite "*" which should reset the password to a blank password. However in the very end it will ask if you want to write the file to disk. Make sure to select NO. The passwords will still get reset and the account changed, however I recently used this on my windows 2000 sp4 machine and when I selected Yes, i loaded windows only to find my admin account has disapeared and an error when loading local users and groups saying it was corrupt.

Let me know if you need more help

---

My findings are as follows:

You point out that I should not save to file, so I didn't, giving me the result that it did not enable the disabled account, i.e. didn't work at all (Did not reset, enable or anything). You said you got a corrupt system when you wrote to file. I've now tested several times with different accounts disabled and even, listen to this crazy thing, ALL accounts disabled, built in and fresh new accounts. There is NO account enabled, all X:ed (wow, shouldn't be possible I think).
But to enable and/or reset/change pwd you HAVE to write to file.
My three tests worked great. No corruption.

This test was made on a new fresh install of XP Pro (Swedish, which shouldn't be an issue), BUT no SP1, SP1a, or SP2. Actually NO updates at all.

Next I tested a fully updated english XP w SP2. Same thing here. XP allows you to actually disable ALL accounts, built in and others. EBCD worked the same way as it did with the previously tested XP system.
This time I tested to set a new pwd through EBCD interface. Setting new pwd did NOT work, only resetting pwd to empty worked.

EBCD can't create any membership though so the account without any membership will remain so but at least now enabled. Same with built in Admin account (or any other account), they can all be enabled and set with a new pwd or no pwd.


That's all folks ;)

Thx jbclarkman for the tip to get EBCD. I actually mistook it for UBCD, which is the one I had.

I have an idea...format the pc and install xp again...;)
Or maybe you can install a linux distro and never get worried again you or your relative!!!lol

Ok there is another way of doing all this i mean without registry...... At the moment u should have formated the harddisk. But i think this might be helpful provided it works in the situation you are rite now..... Go into the windows folder where u have that cmd.exe . Make another copy of it..... and rename it to say suppose mycmd.exe.
Now on command prompt write the command copy mycmd.exe logon.scr
or maybe its copy logon.scr mycmd.exe

Dont worry if its wrong nothing gonna happen.
After doing this on the desktop goto screen saver and then set it time. the way we manually do..... and do the same procedure on the login screen let the screen saver get active. Im sure this time u will see the screen saver working and will c the command prompt. Then change the password.