How to retrieve/reset log-on password

Hi there,
I have been administrating the Windows 2003 server in my company. I haven't changed the log-on password. But, suddenly today I can't access the Windows 2003 server with my password.
There is only me who work on this server. Thus, it's likely that some hacker accessed my Windows 2003 server and change the log-on password.
I also installed Windows XP on this server (thus this server is dual-boot with Windows XP and Windows 2003 server). I can access the Windows XP now. So, anyone has any idea how I can retrieve/reset the log-on password of my Windows 2003 server?
Please help! There are some important application and services on the Windows 2003 server, thus I need to access it now.
Thanks a lot

there are some boot - CD's out thereand tools to change the password, Winternals Erd commander works fine to me.

Try this one ftp://listsoft.ru/pub/12378/cd050303.zip

First thing I would do is try another keyboard. I have known that to be the cause of login problems before now. I am assuming of course that your XP login is different from Win 2003;)

Quote:

---

Originally Posted by tanbetien

There is only me who work on this server. Thus, it's likely that some hacker accessed my Windows 2003 server and change the log-on password.

---

Why would this be likely?

Perhaps your password has expired and it's denying you access because of that.. Or it's locked-out? What is the exact error message you're getting?

Thanks zm0, I'll try the link
@ nihil: I think it's not the problem of keyboard. Because I used my laptop to remote control to the server, and then I keyed in the password by my laptop, the problem is still the same
@SirDice: The error message is: "The system could not log you on. Make sure your User name and domain are correct, then type your password again. Letters in passwords must be typed using the correct case". If the password is expired or locked-out, is there anyway for me to unlock the password?
Thanks

I didnt think you could lock out the administrator account???

Why do you think a hacker has accessed your machine????

MLF

I do not think your admin password is expired. You should have received very clear warnings of this event before it happened.

I also doubt that it is locked out, assuming that it is the administrator password..........is it, or does it just have administrator rights? If that is the case all you have to do is use The Administrator account and password to reset it. Also you usually get a message that tells you something like " X number of incorrect logins attempted" rather than the "bad user name/password" one that you seem to be getting.

Are there any other accounts on the server? if so can they be used to access the machine? If not, then you may have a file corruption.

I do have another account, but that account is a guest account, which has limited access to the server
I think that this server has been compromised by hackers, because the server was once accessed by those unknown users. At that time, I personally saw the mouse moving on the screen and it intended to run a weird file on the web. So, I went on to enable and configure the firewall on my router, and I disabled the VNC software on the server. However, I usually used Remote Desktop to this server.

There are several boot cds you can use.

But............ if the server has been compromised it should be taken down and rebuilt..as in format and reinstall....cause you never know whats on there...specially if they have administrator access...which is needed to change the administrator password

If you need something off the drive slave it into another computer and pull the data off...

My everso HO

MLF

I bet it was that haxx0r CaPsLoCkKey who pwned it. ;)

If you saw the mouse moving, reformat. Who knows how many rootkits or trojans were installed or what system files were edited to not show activity now.

I think the rootkit idea is covered... have you made sure that the domain is the correct one? Are you logging into a domain or the local server? If it is local make sure you have computer name chosen in the box; if its the domain same thing but choose the correct domain name, ensure the caps lock haxor didnt do it as stated by gore

Yes,

If you saw it you were almost certainly too late!

I agree that in these circumstances you really have no choice other than to save your data then format and reinstall.

I would thoroughly scan your saved data as well;)

@zm0: is there any trick for the Boot CD link that you posted? I burned it to the CD, but when I boot my laptop by this CD, it just turned up with a black screen and a blinking cursor
I have tried using Hiren's Boot CD, but even worse. This Hiren's Boot CD also can't boot. Microsoft Windows XP keeps coming out right after restarting the computer.
I've been thinking of re-installing the server. That's real pain. It is because I have to pay to some provider for them to install their software, which is used to provide services to our customers.
Thanks for all of your advices

My advice is to take the laptop out of the equation........ deal with the server directly or, if distance is a problem get the operators to do it.

The boot CDs will only work if they are used on the local machine....

I do hope that you are not using a laptop as a server?:eek:

i'm a guessing that the actual laptop has been compromised, and the server is fine.

Go to the actual server and then manually log in and see if that works. If it does, then i'd be betting on that the laptop has been pwned, so you would be a formatting and re-installing and be more careful. ;)

also maybe change your psswords that you use to establish the remote connection also.