How to retrieve/reset log-on password

[tanbetien]

Hi there,
I have been administrating the Windows 2003 server in my company. I haven't changed the log-on password. But, suddenly today I can't access the Windows 2003 server with my password.
There is only me who work on this server. Thus, it's likely that some hacker accessed my Windows 2003 server and change the log-on password.
I also installed Windows XP on this server (thus this server is dual-boot with Windows XP and Windows 2003 server). I can access the Windows XP now. So, anyone has any idea how I can retrieve/reset the log-on password of my Windows 2003 server?
Please help! There are some important application and services on the Windows 2003 server, thus I need to access it now.
Thanks a lot

[zm0]

there are some boot - CD's out thereand tools to change the password, Winternals Erd commander works fine to me.

Try this one ftp://listsoft.ru/pub/12378/cd050303.zip

[nihil]

First thing I would do is try another keyboard. I have known that to be the cause of login problems before now. I am assuming of course that your XP login is different from Win 2003

[SirDice]

There is only me who work on this server. Thus, it's likely that some hacker accessed my Windows 2003 server and change the log-on password.

Why would this be likely?

Perhaps your password has expired and it's denying you access because of that.. Or it's locked-out? What is the exact error message you're getting?

[tanbetien]

Thanks zm0, I'll try the link
@ nihil: I think it's not the problem of keyboard. Because I used my laptop to remote control to the server, and then I keyed in the password by my laptop, the problem is still the same
@SirDice: The error message is: "The system could not log you on. Make sure your User name and domain are correct, then type your password again. Letters in passwords must be typed using the correct case". If the password is expired or locked-out, is there anyway for me to unlock the password?
Thanks

[morganlefay]

I didnt think you could lock out the administrator account???

Why do you think a hacker has accessed your machine????

MLF

[nihil]

I do not think your admin password is expired. You should have received very clear warnings of this event before it happened.

I also doubt that it is locked out, assuming that it is the administrator password..........is it, or does it just have administrator rights? If that is the case all you have to do is use The Administrator account and password to reset it. Also you usually get a message that tells you something like " X number of incorrect logins attempted" rather than the "bad user name/password" one that you seem to be getting.

Are there any other accounts on the server? if so can they be used to access the machine? If not, then you may have a file corruption.

[tanbetien]

I do have another account, but that account is a guest account, which has limited access to the server
I think that this server has been compromised by hackers, because the server was once accessed by those unknown users. At that time, I personally saw the mouse moving on the screen and it intended to run a weird file on the web. So, I went on to enable and configure the firewall on my router, and I disabled the VNC software on the server. However, I usually used Remote Desktop to this server.

[morganlefay]

There are several boot cds you can use.

But............ if the server has been compromised it should be taken down and rebuilt..as in format and reinstall....cause you never know whats on there...specially if they have administrator access...which is needed to change the administrator password

If you need something off the drive slave it into another computer and pull the data off...

My everso HO

MLF

[gore]

I bet it was that haxx0r CaPsLoCkKey who pwned it.

If you saw the mouse moving, reformat. Who knows how many rootkits or trojans were installed or what system files were edited to not show activity now.