lost administrator password 1

garyw · Jan 14, 2000

Hi 
 
Customer running NT4.0 SP4 had only one admin account & they've forgotten the password. Does anyone know a way around this, apart from using NTRecover & Locksmith?

NumberFive · Jan 14, 2000

have you access to it? 
You might give l0phtcrack a try.

raysinclair · Jan 17, 2000

this is from <A HREF="

http://www.jsiinc.com/TIP0500/rh0554.htm"

TARGET="_new">

http://www.jsiinc.com/TIP0500/rh0554.htm</A>

If you have lost the Administrator password, you must have the following to recover: 
 
1. A regular user account that can logon locally to your Windows NT Workstation, Server, 
or PDC whichever you are recovering. 
 
If you already have an alternate install of NT, skip to The Process, Set 02. 
 
2. The Windows NT CD-ROM and setup diskettes (winnt /ox to make them from the CD-ROM). 
3. Enough room to install a temporary copy of NT (Workstation will suffice, even to recover on a PDC). 
4. Your latest Service Pack. 
 
The Process: 
 
01. Install a copy of Windows NT as TEMPNT, on any drive. Install your latest Service Pack. 
 
02. Boot the alternate install. 
 
03. At a command prompt, type AT HH:MM /INTERACTIVE CMD /K where HH:MM is 10 minutes from now 
(or however much time you need to complete the remaining steps and logon to your primary installation). 
 
04. Use Regedt32 to edit: 
 
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Schedule 
 
05. Double click Schedule and click the one sub-key. 
 
06. Double click the Schedule value name in the right hand pane and copy the REG_BINARY string to the clipboard. 
 
07. Select HKEY_LOCAL_MACHINE and Load Hive from the Registry menu. 
 
08. Navigate to your original installation\System32\Config folder and double-click System. 
 
09. At the Key Name prompt, type ORIGSYS. 
 
10. Navigate to ORIGSYS\Select and remember the value of Current; i.e. n. 
 
11. Browse to ORIGSYS\ControlSet00n\Services\Schedule and if Start is not 0x2, set it to 0x2. 
 
12. With Schedule selected, Add Key from the Edit menu. 
 
13. Type 001 in Key Name and click OK. 
 
14. Select 001 and Add Value name Command as type REG_SZ and set the string to CMD /K. 
 
15. Select 001 and Add Value name Schedule as type REG_BINARY and paste the string from step 06. 
 
16. Select ORIGSYS and Unload Hive from the Registry Menu. 
 
17. Use Conrol Panel / System / Startup... to make your original install the default. 
 
18. At a CMD prompt: 
 
attrib -r -s -h c:\boot.ini 
edit c:\boot.ini and either change the id of the TEMPNT lines to Maint 4.0 on both entries 
if you intend to keep this maintenance install or delete them. attrib +r +s +h c:\boot.ini 
 
19. Shutdown and restart your original install. 
 
20. Logon as your user account and wait for HH:MM from step 03. 
 
21. When the CMD prompt opens, it will be under the context of the Schedule user, 
either the System account or an administrative account. 
If this machine is the NOT the PDC, type MUSRMGR.EXE, if it is the PDC, type USRMGR.EXE. 
If you get an error, click YES and type your domain name. 
 
22. Set the Administrator password and logoff. 
 
23. Logon as Administrator. 
 
24. If you are deleted the TEMPNT entries in step 18, delete <Drive:>\TEMPNT

raysinclair · Jan 17, 2000

here is another method for resetting the password for the lost admin account 
<A HREF="

http://www.jsiinc.com/TIP1800/rh1864.htm"

TARGET="_new">

http://www.jsiinc.com/TIP1800/rh1864.htm</A>

01. Install an alternate copy of Windows NT. 
 
02. Boot the alternate install. 
 
03. Use Control Panel / System / Startup.. to change the default boot instance to your original install. 
 
04. In the original Windows NT folder, navigate to the \System32 sub-folder. 
 
05. Save a copy of logon.scr, the default logon screen saver. 
 
NOTE: If you implemented tip 0028, use that screen saver every time I reference logon.scr. 
 
06. Delete logon.scr. 
 
07. Copy CMD.EXE to logon.scr. 
 
NOTE: If you have implemented tip 0004, set AutoAdminLogon to 0 by using tip 0182 
 
08. Shutdown and restart your original install. 
 
09. Wait for the logon screen saver to initiate. It will actually open a CMD prompt, in the context of the local system account. 
 
10. Type MUSRMGR, into the CMD prompt from step 09, to execute User Manager, and reset the Administrator's password. 
 
11. Delete the logon.scr from %SystemRoot%\System32. 
 
12. Rename the saved default screen saver, from step 05, to logon.scr. 
 
NOTE: If you have implemented tip 0004, set AutoAdminLogon back to 1, by typing Regedt32 into the CMD prompt from step 09. 
 
13. If you wish to keep the alternate install: 
 
Compress its' folder. 
 
ATTRIB -R -S -H c:\boot.ini 
 
Edit c:\boot.ini and change the text of the alternate installs 2 entries to ALTNT. 
 
Implement tip 0012. 
 
14. If you wish to remove the alternate install: 
 
Delete its' folder. 
 
ATTRIB -R -S -H c:\boot.ini 
 
Edit c:\boot.ini and remove the alternate install's two (2) entries.

MrDan · Jan 17, 2000

I've got a crack around here somewhere that if you can log onto the server as any user, you can run the crack and crack all the users passwords in about 2-15 minutes, at least it did last time I used it at a NT class. If you need it, let me know and I'll make arrangements to get it to you. 
 
Dan 
<A HREF="mailto:mooredan@jddealer.com">mooredan@jddealer.com</A>

garyw · Jan 18, 2000

Thanks everyone 
 
Used NTFSDOS to access & copy the SAM file, & lOphtcrack (cheers NumberFive) to get the password list. One happy customer. 
 
Gary

EuanPirie · Jan 18, 2000

Quick question - 
 
How do you get access to the SAM file?

EuanPirie · Jan 18, 2000

Sorry, I'll add to that last post. 
 
I'm using a NT 4 Workstation which is running NTFS. How do I get the SAM file from the machine from the machine? Normal DOS disks will not allow you to view NTFS. A quick guide would be appreciated! 
 
Many thanks.

garyw · Jan 18, 2000

Hi again 
 
I used a normal DOS bootable floppy (actually W95) then ran NTFSDOS (downloadable - try <A HREF="

http://www.sysinternals.com"

TARGET="_new">

http://www.sysinternals.com</A>)

from same floppy. This allows NTFS partitions to be treated as FAT. 
 
From there, navigated to WINNT\system32\config and copied sam file to floppy. 
 
Gary

MrDan · Jan 19, 2000

So did they remember the password after you told them what it was? 
 
I went and found the crack that I was talking about, it's the same one that you used. 
 
Dan

EuanPirie · Jan 20, 2000

Just for information, lOphtcrack, the package that hacks passwords, took about 24 hours to crack one password in the SAM file. It was quite a complicated one, but it did do it. It cracked the other two passwords in about 2 seconds....

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

lost administrator password 1

garyw

MIS

NumberFive

Programmer

raysinclair

MIS

raysinclair

MIS

MrDan

MIS

garyw

MIS

EuanPirie

Programmer

EuanPirie

Programmer

garyw

MIS

MrDan

MIS

EuanPirie

Programmer

Similar threads

Part and Inventory Search

Sponsor