NT 4 System Account Locked Out 1

[dsr771]

Help or Emergency?,

We have an internet server that the system account is now locked out as well as the admin login. This was caused by internet attacks even though we block the ports 135,137-139 at firewall.

The problem is that the lockout duration was set to 6 hours.

Is there any way to unlock the system account now that this has happened?

We don't have any other logins, the server is a standalone server. We can reboot the server, and it comes up, but the webserver doesn't start and it won't let us login.

Hope someone has some good ideas? Tools to boot and unlock accounts?

We will be changing that lockout period after this mess.

Also, If anyone knows how to block these kinds on internet attacks via firewall (it appears to affect win2k servers too).

Thanks

David

 

[Psingh]

Hi,

If the file system on which NT is loaded is FAT then u can just boot the server with a Windows 98 bootable and delet the SAM database file, after that u can login.

If u have NTFS as file system then u need to have a NTFS disk utility called NTFSPRO. With this u can able to boot the server and can delete the SAM database file.

PSingh

 

[twhisnant]

Not sure if this can help but go to

http://www.winternals.com

and lookup ERD Commmander 2003. The locksmith utility will let you change the administrator password on locked out systems. The Admin pak is $199 but includes a 5-day trial in case you need it ASAP...I have ERD Commander 2000 but am not sure if it has the locksmith util. If it does, I can send it to you.

 

[dsr771]

Thanks. The winternals looks promising. I tried their site earlier and it wouldn't pull up, but does now.

I only need the locksmith tool and they seem to only bundle it with the full product now.

I'd like to try the locksmith tool.

 

[dsr771]

Oops, Forgot to reply that the system is NTFS and not fat.

Deleting the sam sounds too dangerous for our needs - we have lots f nt accts that I wouldn't want to lose.

Thanks

 

[datadan]

USE ERD Commander. NTFS ready. Easy to use reset admin password from a boot floppy.