Announcement

Collapse
No announcement yet.

Administrator Password changed

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Administrator Password changed

    Hi everyone,

    I am new to the site. I just found it while doing a search to find a solution to my problem. I am running Windows XP and something strange happen last night with the computer that I am using as a server. It did some updates in the middle of the night and this morning the password I type to log on as the administrator is not working. Luckly for me I have a work around for it but I want to still find the password for the administrator log on. I tried the password recovery tool but that did not work due to the fact that I am running dual harddrives being mirriored using raid. I also tried some other password reseting program but that did not work either. It does not detect the NT drive or something like that. I have yet to use the cracking tool or any other type of tool that may screw something up with the server. I am wondering if anyone has any ideas as to what I can do to get my password or reset it.

    Thanks,
    Tuong

  • #2
    Re: Administrator Password changed

    1) What is your workaround?

    2) I have never found those password resetting tools to work but I have only tried w/ WXP SP2 and W2K3 SP1 (I have to try this stuff to be a good moderator). I also don't like them as they seem to screw up systems as least as often as they help based on my anecdotal analysis of comments here and elsewhere.

    3) I tend to find the "Repair install" with the Shift-F10 feature works though it does a "repair install" and all that can imply.

    4) If you can get the LM and NT Hash, services like Loginrecovery.com do seem to work -- search the Forum for results and caveats.

    5) Replacing Login.scr w/ CMD.EXE no longer works. The AT command "trick" listed elsewhere (other sites) is moot as you need to be an administrator to run "AT"

    6) One of the most novel ways to get a CMD owned by SYSTEM with full privs so you can reset the administrator password is to launch CMD from a service -- either INSTSRV / SRVANY or a service written in VS.NET, etc. I have hinted at this is at least one post. There is an interesting article here to get you thinking:

    http://www.petri.com/reset_domain_ad...er_2003_ad.htm

    So do post back with more info and your technical capabilities in this matter.
    Last edited by rvalstar; 19th February 2007, 09:06.
    Cheers,

    Rick

    ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

    2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

    Comment


    • #3
      Re: Administrator Password changed

      Hi Rick,

      1) The work around I have is just plain luck. I happen to have another account (my account) that has administrator rights. But I am not sure how to go about recovering the password to the administrator login.

      2) I also tried the windows password resetting tool
      http://www.petri.com/forgot_administ...password.htm#1
      that did not work also. I am currently running WXP/SP2.

      3) I am hesitant to use the repair install. Like you said "all that can imply".

      4) I tried using the CD version of LoginRecovery.com. It did not work. The reason is that I am using raid.

      5) Since I have administrator rights with my currently login account, how do I go about doing this?

      6) I am looking into the post. I am not exactly sure what the process in doing this is.

      I am a technical person. I am not the expert that some are but I am better than most. I can function as a Network admin, Tech support, Programmer, or some other function regarding computers. I have built computers, troubleshoot, and what not. This is something that I am not familiar with. But since I have an account with admin rights I think I can do what you have suggested in number 5 or 6. Can you please advise me further?

      Thanks,
      Tuong

      Comment


      • #4
        Re: Administrator Password changed

        Since you have #1, you are on "easy street"

        Open a CMD box and enter:

        NET USER Administrator NewPassword

        And NewPassword is what it will be.

        I love easy solutions.
        Cheers,

        Rick

        ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

        2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

        Comment


        • #5
          Re: Administrator Password changed

          Now if for some reason, you really want to know the original Administrator password, post back and we'll see what we can do.

          Will be interested in the reasoning as I'm just a curious sort
          Cheers,

          Rick

          ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

          2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

          Comment


          • #6
            Re: Administrator Password changed

            Hi Rick,

            I just did the "NET USER Administrator Password" and it works like a charm. I would like to find out what the password was before I just reset it. If you would be able to help me find that out that would be great as it has been bugging me how it was changed in the first place.

            Thanks,
            Tuong

            Comment


            • #7
              Re: Administrator Password changed

              Sorry, you reset it and it is done. Unless you saved the LM / NT Hash off prior or you have a Ghost (or equiv.) backup or...
              Cheers,

              Rick

              ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

              2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

              Comment


              • #8
                Re: Administrator Password changed

                Hi Rick,

                Nope, no backup or ghost copy of it or the NT hash. Oh well it will remain a mystery until it happens again. Thanks for all you help Rick.

                Thanks,
                Tuong

                Comment


                • #9
                  Re: Administrator Password changed

                  Hi Rick,

                  Instead of starting a new thread I am just going to continue on this old one. I am having the same problem again. The admin password is not working anymore. I was wondering if you could help me find out what the password was changed to before I go ahead and reset it again.

                  Thanks,
                  Tuong

                  Comment


                  • #10
                    Re: Administrator Password changed

                    No prob on continuing your thread esp. since it is fairly fresh.

                    A different machine where you are a local admin but not Administrator? Or the same one and the local Administrator pwd got changed in a matter of weeks?

                    I'd say the NET USER Administrator bit is your best bet but I'm guessing you're dueling w/ others that keep changing it?

                    Please elaborate a bit more on what the current situation is and how you got there.
                    Cheers,

                    Rick

                    ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

                    2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

                    Comment


                    • #11
                      Re: Administrator Password changed

                      Hi Rick,

                      I understand that NET USER is the best bet. I am just dumbfounded as to how the password is being changed on the administrator when I am the only one that knows it. The problem usually occurs right after the computer reboots itself. This usually happens overnight and not during the day. Afterwhich the password doesn't work. Again this seem to have just happen recently and only the admin password is not working. It is also a bit of a mystery as to why the computer is rebooting itself also but that is a different issue that I will resolve.

                      Thanks,
                      Tuong

                      Comment


                      • #12
                        Re: Administrator Password changed

                        You certain the account isn't getting locked out because someone is attempting to use the account w/ an old password to connect a file share or start a service?

                        The password changing would be my first concern.

                        If you are convinced the password is changing, then who is doing it?

                        You are still a local admin on the box through another account? Please confirm and I'l post some things to try to if you want to go down the password recovery route.
                        Cheers,

                        Rick

                        ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

                        2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

                        Comment


                        • #13
                          Re: Administrator Password changed

                          Hi Rick,

                          Yes, I still have my local admin account. I am pretty positive no one else is trying to use the admin account with an old password. I am the one that started up the system and try to log on after it had rebooted. Upon rebooting, the system will stop at a point and ask to press F1 to get pass the raid portion of the startup. Only one other person in the office knows how to log on the to the system and he is not very computer savvy so he won't know how to change the password or anything.

                          I am still interested in the password recovery route to find out what the password currently is if it is not the one I changed it to last time. Thanks for all your help so far Rick.

                          Thanks,
                          Tuong

                          Comment


                          • #14
                            Re: Administrator Password changed

                            Originally posted by Tuong View Post
                            I am still interested in the password recovery route to find out what the password currently is if it is not the one I changed it to last time.
                            I'd start here:

                            http://forums.petri.com/showthread.php?t=13906

                            Since you have admin rights, the easiest way is to use SamInside to find the LM / NT Hash in PWDUMP format then massage that into LoginRecovery format (I discuss this is a thread linked in the one above).

                            Alternately, you can just get the LoginRecovery boot CD or floppy and try that.

                            Post back any questions / problems you may encounter. Also, do let us know how it went.

                            Best of luck.
                            Cheers,

                            Rick

                            ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

                            2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

                            Comment


                            • #15
                              Re: Administrator Password changed

                              Hi Rick,

                              I tried using the CD that comes with LoginRecovery and it did not work. Something about the way the hard drive is setup using the raid that it was unable to find it. I used SamInside and was able to pull the LM / NT into PWDUMP. I submitted the information to LoginRecovery's website to get it decrypted. I am just waiting on the email that tells me it is done. I have not gotten the email just yet. I will update with the final results.

                              Thanks again,
                              Tuong

                              Comment

                              Working...
                              X