big problem ... need help

First things first:

Windows 2000 professional/ service pack 2...

This computer is in my stepfather’s office. It is his personal computer on which he stores all the information for his company. The system is set on automatic logon for the original built-in Administrative account. The Administrator account had a blank password. At some point we decided to actually change the password into something. Let's call that password "fish". At that point I've noticed that the "full computer name" was a random combination of letters and numbers exactly the way windows installation picks them IF and only IF you don't provide the name yourself. (Those of you who installed windows before, you know what I mean)

So:
1. The password was changed.
2. The “full computer name” was changed
3. The system was left on automatic logon of account “Administrator”

After that, system requested a reboot.

After I rebooted the system. The OS was trying to auto logon w/ the password but it said that the “system was unable to log you on”. How the hell can system tell itself that it cannot log itself on? What the hell did happen? There was no other account on the system so now it’s unusable.

So at this point I figure, **** it. Let me put the HD into a different system and pull the company files out manually and then I figure something out. I noticed that some of the files couldn’t be copied. So I tried to systematically copy what I could. Erase unnecessary content and leave everything that won’t move.

At this point I noticed that somebody turned on EFS (encrypted file system)

Can anyone, anyone help with what to do now. The files won’t move. Is there a cracker or some kind of software you guys have some experience with? This is very important for my to help this guy.

I also tried to use the trial version of Advanced EFS Recovery to see what it can/cannot find but It won't work becuse (I think) It can only find partial keys/hashes. What should I try to undelete to make it find more hashes?

You need to take OWNERSHIP of the files you want to copy
Right click..security..advanced (ithink...sorry brain is infected with brandy :) )



As for encryption...AFAIK.....if you dont have the key file...your f#$ked

MLF

It appears you have been having trouble with this for a while. ( guess your ass checks are puckering at this point? )

Sorry.
From what I remember of your previous posts you have been trying to secure what you believed was a situation for disaster.

I have not reviewed your past threads, but have you tried the M$ Windows 2000 recovery Console ?
( do you Know how hard it is to type out that URL when you are drunk? )

just a suggestion. I believe that is where to start.

Unhappy,

familiar with rainbow cracks ?

Well, get pwdump 2/3/4 any version, depending what you need to do. An simply grab the Administrators hash.

Then send me the hash, i can see what my tables can do about it.

Any problems msg me

BTW: This is probably the most reliable, non-intrusive, method of retreiving the data encrypted using EFS

Send me the hash too, see what I can do...

When you noticed that the computer name had changed you should have stopped immediately. Changing the computer's name alters the SSID of the administrator, (the only person who can access an EFS encrypted folder in the case of loss). Once the SSID of the admin is changed then the ability to unencrypt the EFS folder is gone.

Now, if you put the drive back in the original box, (unchanged I hope), there is a linux boot disk that I have had success with that will set the administrator password to <blank>. I'm not at work right now where it is but I can hopefully get you the place to D/L it if you can't Google it. It worked perfectly for me getting into a Win2k server that I set up for being publicly available and outside the firewall that I promptly forgot the password for.... :o

tiger ... i tried the linux disk but it didn't work ... (i know enough to use it correctly)

i have the whole disk so where can i find the hashes you guys need

...but the disk won't boot on me anymore ... i can only pull them out from another system

fuking encrypted file system

Quote:

---

Now, if you put the drive back in the original box, (unchanged I hope), there is a linux boot disk that I have had success with that will set the administrator password to <blank>. I'm not at work right now where it is but I can hopefully get you the place to D/L it if you can't Google it. It worked perfectly for me getting into a Win2k server that I set up for being publicly available and outside the firewall that I promptly forgot the password for.... :o [/B]

---

I was under the impression that you couldnt set the admin pwd because it would change the EFS encryption key aswell...

@unhappy

use pwdump version 2, 3 or 4. 3 and 4 allows you to retrieve the hash via network (?) But if your using local access any of those versions should work for you.

Well, I am not sure what you were trying to do:

Quote:

---

3. The system was left on automatic logon of account “Administrator”

---

That is not a "security policy" that I would recommend.;)

Also, what was changing the computer name supposed to do for you? :confused:

Double//Cut

One of us is missing the point here? I do not think that it is a "cracking" issue..............he has one account "administrator" and he knows the passwords...........first it was blank, then he changed it to "fish" or whatever.

To my limited understanding this is a SSID/SAM issue, not a pasword one. It is a question of identities, authorities and permissions? ..............not one of passwords.............unless, of course the password file has become scrambled.

If the Knoppix boot CD won't do it for you, then I think that you have problems greater than you have mentioned.................file corruption perhaps?

You might try "Unstoppable Copier" by roadkil, then try logging in as Admin on another box and taking "ownership" of these encrypted files on the new drive. You might get past the encryption that way.

Tiger~ and Morgana~'s solutions should have worked, which does not give a great prognosis..................particularly as I am sure you did not write down the original computer name.............?

Assuming that the password files have become corrupted:

1. Mirror the hard drive onto a new one
2. Defragment it
3. Take ownership of the files as administrator and see if you can open them.
4. Run some hard drive diagnostics against that old drive............I have this feeling...........
5. Try the password recovery suggestions and note what the "real" password is.................those "recovery" tools can help if the password has become corrupted;)

Good luck

My view on this is..................Unless you can crack EFS.
You need to reverse all the changes you made. Did you note down the computer name?

the thing is that everything on the disk in question can move or be overwritten but the encrypted files won't move at all ...

what can i do to make them usable ... i know the admin password ...

in what way are these hashes encrypted ... for christ sake i know the password there has to be a way to decrypt them

remmember ... i cannot boot the disk... i can only use it as secondary master on my machine which has a different admin account

the original computer name look similar to this "X-LFSDLKHJ34LHLDF" which is a random sequence that the installation makes up if you don't specify the name.... all i wanted to do was change it to something nice like "office"

I think your problem is highlighted here:-

Quote:

---

File encryption uses a symmetric key, which is then itself encrypted with the public key of a public key encryption pair. The related private key must be available in order for the file to be decrypted. This key pair is bound to a user identity and made available to the user who has possession of the user ID and password. If the private key is damaged or missing, even the user that encrypted the file cannot decrypt it. If a recovery agent exists, then the file may be recoverable. If key archival has been implemented, then the key may be recovered, and the file decrypted. If not, the file may be lost. EFS is an excellent file encryption system—there is no "back door.

---

Oops... hang on... Pressed Submit instead of Preview :o

To continue....

Coupled with:-

Quote:

---

EFS keys are protected by the user's password.

---

Remember, when you change the domain or workgroup the user's identity, (SSID), changes too....

And finally.... here:-

Quote:

---

It might also result in a loss of data, if proper recovery steps aren't taken.

---

Source

It seems to me that the appropriate recovery steps weren't taken, as the article says... It's easy to use but can "bite you in the....", Ok, I paraphrased.... Sorry...

If you have a _full backup_, (system state), of the old system you _might_ be able to recover the files otherwise, as it says here:-

Quote:

---

File encryption uses a symmetric key, which is then itself encrypted with the public key of a public key encryption pair. The related private key must be available in order for the file to be decrypted. This key pair is bound to a user identity and made available to the user who has possession of the user ID and password. If the private key is damaged or missing, even the user that encrypted the file cannot decrypt it.

---

you are up "that" creek without a paddle..... Since, as you already stated, the hashes are incomplete... IOW, the pair is no longer intact - due to the change of identity of the box itself.

It's no longer an issue that you know the admin password... It's an issue of whether you can recreate the domain/workgroup SSID having an administator with the same password.... Good luck on that, SSID's are deliberately long, random and hard to guess.

I hate to say this, but it's time to move on......

Quote:

---

remmember ... i cannot boot the disk... i can only use it as secondary master on my machine which has a different admin account

---

This is your main problem, unless you can import the security certificates for the encrypted files, you need to get the disk to boot.

Been there....done that.....(once computer name is changed, files don't belong to the original owner)

My solution was to attach the drive (direct IDE cable, or external USB box) to a Windows 2000 Server, then take ownership. Copy to a shared directory. Put the original hard drive back into its computer, and download the 'shared' files. (or burn to a CD)

Bit pricey if you don't have WIN 2K server.

why do i need windows 2000 server ... i do have it but it's not installed

did you use encryption as well on the files...

Windows 2000 server WILLl 'take ownership' of the files. No encryption on the files.

(I tried taking ownership with XP...but it wouldn't work)

I presume Win2K Server has more 'rights' than any operating system. (Just a guess)