I've got a client who has an machin 1

[zoonkai]

I've got a client who has an machine running NT 4.0 and he does not have administration rights to the machine.

Just in case anyone is worried that I'm trying to hack this machine I'll make this statement. The machine belongs to an organization that is doing training classes for the local community college, however when the IT guys from the college came in to set it up on the college network...they changed passwords and took all his rights away....he can't even shut his machine off without pulling the plug.

He has physical access to the machine (in his office).
he has the original disks (but would prefer not to have to reload the machine.

i know in SCO Unix...if you make a boot disk then boot up on the machine....you come up as root automatically...then you can change the password.....is there a backdoor in NT like this ... for forgotten or changed passwords...etc.

Any help on this would be greatly appreciated!!!

Thanx
Donald

Donald (Zoonkai) Dixon
donnan@don-nan.com

http://www.don-nan.com

 

[wallerkr]

What happened to the IT guys - they should be able correct that situation. We would have to have an agreement before I would let someone set up MY machine on their network and prevent me from having admin rights to my own machine. Sounds like the IT guys didn't know enough about NT security.

If he as an ERD he could use it to reset the SAM and start over security-wise. I had to do this when I installed my NT workstation way back when (and didn't understand the admin rights (or lack of) on a workstation.

 

[zoonkai]

The IT guys refuse to give him more authority...even though they're not even using the computer at all....he's been trying to get them out there for over a year, unsuccessfully.....as soon as he offered to let the computer dept (of students) use his machine for their learning, IT ran out there and said...NO!! you can't do that....(don't ya love the way some colleges work)


I really don't know much at NT...I'm a UNIX guy myself...could you explain ERD to me..?

Thanx
Donald Donald (Zoonkai) Dixon
donnan@don-nan.com

http://www.don-nan.com

 

[wallerkr]

I guess I am still confused - the only authority he would have would be over his own machine. I would never dream of restricting one of our vendors from administrative access to his own laptop or desktop that he/she uses to connect to our domain. I can control their access thru user admin quite easily.

Yea, so much for learning!

The ERD is an Emergency Repair Disk. It is a backup of sorts containing critical system registry info, security account manager (SAM) database, disk configuration and other system parameters.

Hope this helps.
Assuming he knows how to use it, he can restore the SAM to the state it was in when the ERD was created (assuming he knows an admin id and password that was valid when the disk was created).

 

[Voyager1]

Norton makes a product called ERD Commander Pro, which will allow you to create a boot disk that allows you to change the Local Administrator password exclusive of the NT Rights set. May be an option.

Only problem with the NT ERD is that is will only set the SAM back to when the ERD was last updated - might still have the same problem.

 

[MasterRacker]

The IT guys are the problem here. As wallerkr said, they can grant him full local administrative to his own machine without compromising their network at all. If this guy doesn't actually work for the college, the college's IT guys do not have the right to do this. He could certainly threaten to get his lawyer involved or something.
Jeff
masterracker@hotmail.com

If everything seems to be going well: you don't have enough information.......

 

[uriel717]

Just a note as a Systems Admin...

It's pretty standard for very large networks (like at a University) to have a standard build and config for all machines. This minimizes your troubleshooting. You don't find yourself spending cycles trying to figure out way a standard app is crashing only to determine that a custom screen saver that the user installed is to blame. This is why IT Managers will almost never grant local admin rights to users on such networks. The users don't own those machines and they have no right to add or change anything on them. The machines are configured to allow a user to do his/her job and that's all. It really is the best way to go.

That said, it is REALLY easy to change the local admin password using ERD Commander and I'd recommend getting a copy of the boot disks it uses. If you do, just boot from the floppies and you'll get dropped to a &quot;C:\&quot;. Then type REGISTRY to load the local hive and the type PASSWORD. This shows you the local accounts. You should see ADMINISTRATOR in the list. Then just type PASSWORD ADMINISTRATOR <password>, replaceing <password> with your new local admin password.

After that you can load up the User Manager, double-click the Administrators group, click Add and choose the DOMAIN\Username used to login normally. Close it all, logoff as administrator and login as the regular username which now has local admin access.

 

[MasterRacker]

Uriel,

From what is written, it is not the college's machine. They were supposed to be configuring access to their network for a consultant but it is his mahicne, so they shouldn't have locked him out.

Beyond that, I agree with you completely and, in fact, treat my own network exactly as you describe.

Good tip on the PW fix by the way.....
Jeff
masterracker@hotmail.com

If everything seems to be going well: you don't have enough information.......