win2k professional admin user account deleted

[snorwood]

Team,
I have a client who has deleted the local administrator account through the administrative tools/computer management/local users gui. The only account we have been able to gain access to this computer with is the guest account in safe mode. Is there any way to restore the default accounts or create a new admin account? They have no ERD.
Thanks,
Snorwood

 

[eryctus]

I take it you have tried the "Last good known Configuration" boot option (F8 during bootup)

 

[Jasen]

Pop that drive into another win2k machine and delete the SAM file. ________
Remember, you're unique... just like everyone else.

 

[jeepdc]

I didn't think you could delete the local admin account (the built-in admin account created upon setup). You can obviously create another account and give it admin privledges and delete this account. There should always be a built-in admin account. Windows doesn't let you delete the built-in admin account.
-DC

 

[Cadwalader]

Hello,

jeepdc is correct, the Administrator account CANNOT be deleted (at least not through the GUI, it won't let you), it can be renamed, however. Hope I was of some help...
--OR--
Thanks for the help...
--Rich

 

[wolluf]

Jeppdc/Cadwalader

Have you tried? You might be unpleasantly surprised.

 

[Cadwalader]

Actually, yes, I have tried. The name "Administrator" didn't appeal to me. I've tried, the GUI will not let you delete "Administrator". Hope I was of some help...
--OR--
Thanks for the help...
--Rich

 

[Jasen]

It can be removed through the registry. ________
Remember, you're unique... just like everyone else.

 

[wolluf]

snorwood

Is it a standalone/workgroup machine (if connected to domain, may be domain user with admin access)?

Can you see which accounts are still left on the machine? Are any likely to be members of admin group?

I've seen that deleting the SAM file trick mentioned before - but when I tried it, I just got an error after windows booted - couldn't get in at all. There are methods of changing passwords without knowing current using linux based boot disks, but that's no good unless you've got an administrator level account.

Best bet may be reinstalling 2k on top of itself (after backing up data you don't want to lose of course).

PS. Have you tried running recovery console? (that needs the administrator account password - so you could find out if windows still has this stored somewhere or not) or logging on with user Administrator, no password?

 

[Cadwalader]

jasen,

I never thought of that. But...

"Team,
I have a client who has deleted the local administrator account through the administrative tools/computer management/local users gui."

...that's why I said it had to have been renamed..
But your right about the reg, just about anything can be deleted from there.
Hope I was of some help...
--OR--
Thanks for the help...
--Rich

 

[vtshep1]

I do not know if this will help but I have renamed my administrator account, and subsequently added another account named Administrator. I think you can delete any account as long as their is another their. If it will not let you simply add one in again you can always add another account as stated above, and give it administrator status. You should check and make sure that the local security policies in the administrator tools allow for the operations you need for the new account.