someone, was smart enough to block all his users in win xp
and is asking me for help...
i have no clue
can i run as system?
any trick....any thing i should try
i just don't wanna format!
and i think this can be useful for future
Printable View
someone, was smart enough to block all his users in win xp
and is asking me for help...
i have no clue
can i run as system?
any trick....any thing i should try
i just don't wanna format!
and i think this can be useful for future
Try accessing the hidden admin account from safe mode. Assuming this is XP home - don't know off the top of my head if it applies to XP Pro.
Gluck.
If (on the unGodly chance) the hidden Admin account is disabled, you're talking a walking nightmare to fix the accounts, but it can be done by editing the sam file - the solution is posted somewhere on this site. You can find it by searching out 'sam'. I didn't search it for you or post the link because I'm suggesting the other alternative: Reinstall Windows. I make this recommendation because a reinstall cures a plethorae of problems, including whatever it was that caused these accounts to go invalid in the first place - unless it was (l)user error...
Luck to you!
I do not understand how all users can be disabled atleast the account (the one used to disable all accounts has to be active) this is in case of both windows xp home/pro edition.
Default administrator account can never be deleted and can only be renamed.
Skiddie Translator says:
I dont know the passwords for the accounts on this machine, is there anyway I can get access to it without permission.
/translator
think about it. How could someone accidently disable EVERY account. you cant disable an account you or anyone else is logged into. And you cant disable the default admin account. so there is atleast 1 open account somewhere. Im not saying it impossible, but if you knew how to do this you would certainly know how to fix it.
maybe I am too paranoid. *shrug*
Greeting's
exactly there is no way anyone can disable all the account including the Default Administrator account. Even if you delete the sam the default administrator account stays.
Actually you can disable the Admin accounts based on this Article here. I've been trying to find if there is something in the registry that could be reversed but haven't found anything. At worse apparently this might work (YMMV):
I suspect this is an XP Home only solution (you didn't indicate whether it was Pro or Home).Quote:
Source
Boot up the PC
Press F8
Select Safe Mode
In welcome screen press twice CRT+ALT+DEL (only needed if welcome screen is ON, if not then you already are in old 2k login mode).
Put in login: Administrator (depending in language version of XP)
Put the Passwrd (usually is blank by default and if you didnt change it)
Bumm you are in...
Then inside computer manegement put Administrator as enable.
Restart
Using "net delete" command in windows xp (I have tried on home edition, I am not sure if there are any negative efffects on the system) but that works. Only thing i am trying to say is how can all the accounts be deleted at the same time
like i said, if you can figure out how to do this then you should be able to undo it. and Im not even too sure this will work, Im going to test it when I get t my winxp box.
Got an easier method here MsMittens:
Delete, rename, or move the sam file. Oops. There go All the accounts (including the hidden admin ByteWrangler.). (l)user error is a definite possiblity when the (l)user in question thinks he knows a bit about computers... After reviewing some of beee's earlier posts from his profile, I strongly suspect he's that kind of (l)user... :rolleyes:
That's actually a suggested method to account recovery when the password is lost by some (not one I'd use but it's out there). That said, why not find out if there is a way to get back an account if all have been disabled? It's a challenge. There has to be a registry entry somewhere. Just the question is which one.Quote:
Delete, rename, or move the sam file.
muhaha! I love a good challenge. 2 seconds of searching brought me this:
http://www.antionline.com/showthread...admin+password
http://www.antionline.com/showthread...&highlight=sam
http://www.antionline.com/showthread...&highlight=sam
All with wonderful suggestions within them to help the situation, and outward-bound links to other softwares and other methods.
Hrmm.. but will it re-enable the account or just change the password?
Well... After my "excursion" into WinXP Home, (should be renamed to Luser Mode), I'll make the following observations.....
1. The "important" Net.exe commands don't work in XP home... Well, they _might_ if you have admin access... They sure as hell don't on a normal account.
2. I'm pretty sure that simply deleting the SAM, even in XP Home, will cause a total non-bootable situation... I didn't try it, but Win2K doesn't boot without a SAM file to reference and, IIRC, neither will XP Pro.
3. XTC.... Good luck... See this thread.
4. In XP, even XP home, you cannot delete the admin unless another account has been designated admin. The same has to apply to disabling the account, doesn't it?
As a "suspicious old bastige" side note.... One of my users has had the important accounts deleted twice regardless of the rules that say this can't happen.... Now we have one where all the accounts are disabled.... which, I don't believe can happen.... Is there a pattern forming here?
hey guys..
one thing we didnt ask what exactly he meant by "Disabled"
there is malware that hijacks the userinit file.. this prevents even the Admin account from being accessed.. symptom.. you only get the logon screen.. you may get to see the desktop background but you will quickly be returned to the logon..
so I recommend instead of postulating the problem.. we ask a few more questions..huh?
Hmmmm. I saw this recently on a Compaq tablet. Desktop Support asked me to come help out; the user had reinstalled the OS on his own, and now couldn't remember the Admin password.
I fired up UltimateBootCD and went to change the password, and it showed all accounts as Disabled. I tinkered with it some but had other things to do, so I left it be.
I'm curious how or why this happens. Is this some sort of licensing response? If you don't activate, it makes the user accounts unusable?
?Quote:
Is there a pattern forming here?
1-Try accessing the hidden admin account from safe mode.
2-editing the sam file - the solution is posted somewhere on this site. You can find it by searching out 'sam'
3-Boot up the PC
Press F8
Select Safe Mode
In welcome screen press twice CRT+ALT+DEL (only needed if welcome screen is ON, if not then you already are in old 2k login mode).
Put in login: Administrator (depending in language version of XP)
Put the Passwrd (usually is blank by default and if you didnt change it)
Bumm you are in...
Then inside computer manegement put Administrator as enable.
Restart
4-Using "net delete" command in windows xp
5-
http://www.antionline.com/showthrea...+admin+password
http://www.antionline.com/showthrea...p;highlight=sam
http://www.antionline.com/showthrea...p;highlight=sam
6-there is malware that hijacks the userinit file.. this prevents even the Admin account from being accessed.. symptom.. you only get the logon screen.. you may get to see the desktop background but you will quickly be returned to the logon..
7-i suggest you goto the shortest wat "FORMATTING", i'm sorry to say that ,but, by login a machine without having the passwrods !!!!!
its some sort of hacking stuff....
nice condensation of the thread so far.. please if your going to C&P other peoples post give some of us some bloody credit will you.. or at least learn to use the quote
:D LoLz! Nice one, Und3ertak3r!
modafar, you got him?!
Cheers!
Yo!
TS - I think there might be.
deleting the security hive will work in 2k but i heard that it didn't work on xp but i've never tried. i use "Offline NT Password & Registry Editor, Bootdisk / CD" which can be found Here
not only will it reset the password but it will also enable a disabled account.
edit: although it say's NT it works also on 2k and XPsp2 and 2003 server. this is a must have
hehhey ppl...
someone was saying that i have bad intention
the truth i don't
and someone did a search about my posts... woow(even not so many :P)
working on win xp pro... not the home edition
and about disabling all the users, it is not that magic...
a user did it... not a pro guy or something... and i was bothered as i have to fix this...
did not think windows would allow him
right click on ur computer, manage, users and groups...
when u see the users, u have to right click , properties and disable
lool
try this...
is it a big finding hahahahhahahaha
i read lot of above... intresting.... good
first the screen i got, is the welcome screen... blue, but no users to click
and when i get the thing where i have to type the username and pass
i type them correctly... but it tells user have been disabled. plz check ur system administrator
ummmmm
and even in safe mode, i would always get that screen...
wish have the same case... or a free pc...would love to try some stuff
intresting learning
10x for ur replies guys...
enjoyed it so far....any more
i know how to do this... but this is for information for other users
how would you have ur files back from that computer considering that u can't log in...
duh....
Yep, and that makes you just as big an idiot as the guy you told to do it. Have fun trying to fix it (l)userboy. I was honestly having second thoughts about having negged you in that other thread until I read your above post... Now I wish I'd have negged you harder you ****ing retard.Quote:
a user did it... not a pro guy or something... and i was bothered as i have to fix this...
did not think windows would allow him
right click on ur computer, manage, users and groups...
when u see the users, u have to right click , properties and disable
beee you are a moron.
well, you could use a cd like WinPE or a number of any other boot cds and retrieve them, you can use specialized file restoration software, you can reinstall the os ontop of the old filesystem, you can slave the drive, yea there are alot of ways to do this.Quote:
how would you have ur files back from that computer considering that u can't log in...
duh....
Apart from your crappy English which I put down to laziness rather than it being your second language looking at the way you write could you please tell me how anything you have written in this thread has enlightened anyone.... Whatever you have written to date is so imprecise and disjointed that no-one except you can understand a word you have said!!!!!Quote:
i know how to do this... but this is for information for other users
I'm beginning to think even HE doesnt know what he is saying.
Beee,
FTBOTD (4 d benefit of the doubt),
- What do you mean? I feel st2pid already trying to dig it! Should I say, please re-phrase!Quote:
and i was bothered as i have to fix this...
did not think windows would allow him
right click on ur computer, manage, users and groups...
when u see the users, u have to right click , properties and disable
lool
try this...
is it a big finding hahahahhahahaha
* Of course, I know how to disable "not-needed" accounts like guest, but...
-what is the purpose why the "not a pro guy" manages to go to these settings and play with it, BTW have you told him and adviced him not to play with such if he can't undo it? I assume you did. :)Quote:
a user did it... not a pro guy or something... and i was bothered as i have to fix this...
*
Next time you ask, consider giving us information that you_actually_know the solution already, rather than let anybody think that you’re st2pid or something because now I think you are.Quote:
i know how to do this... but this is for information for other users
how would you have ur files back from that computer considering that u can't log in...
duh....
Thank you!
Yo!
hey guys.... eazy eazy
okey... sorry did not use the check spell.. hehe... won't use it this time also
said "not a pro guy", cuz lot of ppl here started theorizing and saying that can't do this and if u can do it, u can undo it and stuff like that
everybody at my great work is logged in as admin... they don't wanna bother do some security
why should i worry about it .... they don't do a backup... even i keep nagging, immagine what if i tell them this is security hole, they will say then u were thinking of breaking in ....
but this accident made me wonder how to fix this....i did not find a way at the moment and now don't have a pc to test... that is why i asked !!! and to make other ppl know what they will do if the same thing happens with them
at the end, seeing the average level of ppl here in these forums, i wanted to make sure that mr X newbie user that might not know how to recover his file gets an answer....
so i was trying the conv to go on..
i know there is a million way... and i wanna know them all
okey i know the slave, i know how to use knoppix to recover them...blablabla
maybe there is something i don't know and someone posted it!
what is the point of forums then without this? other than knowing how u think
and oh one last thing off topic scratchONtheBOX, in ur sig... saw the animated cube, it is the same as on a site: MeterSite (for site statistics and hits ), made me think, do u own it?
beee, have you tried Tedob1's suggestion??
Hi Beee,
Sorry for late reply. About the OFF TOPIC THING... I had sent you a private message about it. If you are not satisfied with my answer there, I could also send you the full header for the transmission. ;)
And to Sir David Smith of SiteMeter.com (if ever you could read this thank you message), thanks again for your permission and best regards. BTW, I appreciate the services you offer.
Yo!
If they have the recovery console installed during XP setup they can run it and get access to the admin account(I think)
They have instructions on this page on how to use it for Home or Pro
http://www.winxpfix.com/page18.htm
Successful in XP Pro with FAT32 System
- Successful in FAT32 System (since my 2nd partition is FAT32)Quote:
ORIGINALLY FOUND HERE - http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html
That was all. The disk fixup is only run on NTFS filesystems, and will force chkdsk next time windows boots.
- I have tested it in a test partition and it is PERFECTLY WORKING! Here a quick testing I have done for my BoX:Quote:
i use "Offline NT Password & Registry Editor, Bootdisk / CD" which can be found Here
not only will it reset the password but it will also enable a disabled account.
For the benefit of Beee’s point (about disabling all ACCOUNTS_including_current_user), I can admit that it really works (sorry guys), but still it doesn’t mean that a WELL-AWARE user should disable all accounts for any good reason than testing solutions like this, OK Beee? OK.
- I install an XP Pro in my 2nd partition (FAT32), done the basics, and DISABLED all accounts, restarted and found out the dillema about the “Account is Lock” state on all accounts (of course, we disable it all).
- Try to work around with Safe Mode, Admin Mode, all modes.Although the Recovery Console that came up with the ORIGINAL Win XP Cd I think could do something, but I skip it and go on try another solution.
- Going back to Tedob1’s excellent suggestion, I downloaded the Bootdisk app and followed the procedure. Created a Bootdisk and go on smoothly from booting to re-enabling administrator account. Restarted and here we go. Admin account was reset and the BoX restarted normally. Go to the accounts settings, enable other accounts, and create STRONG PW for admin.
It proved what?
A) Beee’s point (about disabling all ACCOUNTS_including_current_user) is TRUE.
B) Tedob1’s excellent suggestion WORKS in solving such issue.
Now, here I am, kissing the Floppy for a job well done :)
Simply, end of story.
Cheers and Peace!
Yo!
first 10x for testing the solution and putting an end to this conv that started to get bit :S
and sorry about my comment abut the picture in ur signature, it is that i couldn't help myself making the comment... i sometime surprise myself... how could i trace the pic back to the site
by the way.... i registred to it...after ur comment abut it :P
but if i don't test anything how can i learn?Quote:
than testing solutions like this, OK Beee? OK
cheerz... bye
I'm bringing this up because of some events today in my wargames labs. One of my students who had been having problems logging in attempted to recover with the NT Offline Password floppy. Didn't work. As it turned out, Guest was still enabled (thankfully!) and when we got in I decided to check to see what the admin account had been renamed to (although the floppy kept saying that administrator was the account name for the 500 SID).
I looked in users. No administrator.
I look in groups, under Administrators. One account: administrator.
From what I can tell, the account was deleted from the users but not from groups itself. I didn't get a chance to do forensics and I'm going to ask the student not to erase the disk because there is an opportunity to learn and figure out what happened. No one is claiming credit for it (rather creative for a remote attack).
I am curious if anyone has suggestions as to where the account is.