Announcement

Collapse
No announcement yet.

Need help recovering admin password in Windows 2000 Pro.

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Need help recovering admin password in Windows 2000 Pro.

    Hey all,

    I'm a computer technician and I own a computer store. Someone related to me (my father's aunt) brought in her computer today, asking if I could fix it because she couldn't log in since she doesnt know any of the passwords. Aparently her son installed Windows on the computer and she doesn't know the passwords to it, the person who does know is out of town and the password he gave me for admin does not work, and he has no idea what else it could be.

    I tried doing the logon.scr trick in hopes that it would work, but when I do I get an error saying I don't have the proper permissions to change the password. From the net user command I can tell that there are the following user accounts on the system:
    -Administrator
    -Guest (locked)
    -Terry
    -Mom
    -Kids

    Each of the user accounts are unfortunatly password protected in which no one seems to know the password. I have tried a few things that I can think of and I can't seem to get in.

    The other solution would be to do a backup and reinstall. My only problem with this, the computer was setup in the stupidest way I have ever seen. There are 2 hard drives and each one is split into 2 partitions. There is stuff everywhere and alot of files needing to be backed up, and a lot of programs of which I dont even know where the cds are and they don't have some of the licenses anymore (or the son that is out of town has them). My other problem since it's approaching taxes, they need this back asap.

    I'm really out of ideas, I'm hoping someone can help me in giving me a way to recover or even just log in to this computer, or anyone that knows a way I can get in to change/reset the password. It would save me so much time, and trouble if I could just log in. I personally hate and dont understand how you can forget every single password on your computer, but it's the problem I am faced now.

    So does anyone have any ideas/tricks/ways of getting me into this system. I am able to slave the hard drives, or anything.

    Something I was thinking, would it work if I did the recovery console and reinstalled windows on top of itself? Does that reset the Administrator password? Or prompt you to give a password?

    Thanks for all and any help/ideas,

    -Dan

    ~~~UPDATE~~~

    I found that I am able to launch explorer.exe by doing the LOGON.SCR trick, and when I run explorer.exe I turn out to be logged in as NT AUTHORITY/SYSTEM. This user account doesn't seem to have much access to anything, not sure if there is a way to modify passwords or do anything based on this account.?
    Last edited by BlueD; 27th February 2007, 19:46.

  • #2
    Re: Need help recovering admin password in Windows 2000 Pro.

    Wow. That's an impressive 1st post.

    Since you have access to other machines, you could mount the boot drive as a slave in another machine.

    Then run SAMInside against that drive's SAM and SYSTEM files and export the hashes to a text file in PWDUMP format.

    Next massage into www.LoginRecovery.com format and see if they can find the password

    THEN decide to wait the 2 days or pay for immediate answer.

    Here's some info on all this:

    http://forums.petri.com/showthread.php?t=12843
    Cheers,

    Rick

    ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

    2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

    Comment


    • #3
      Re: Need help recovering admin password in Windows 2000 Pro.

      BTW, here's an explanation of why LOGON.SCR and your Explorer.exe bit don't work:

      http://forums.petri.com/showthread.php?t=330

      DanielP has updated the main site on this here:

      http://www.petri.co.il/forgot_admini...ogon_trick.htm

      but does not explain why. The explanation is important to anyone that sees they can get in as SYSTEM, albeit a neutered SYSTEM.
      Cheers,

      Rick

      ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

      2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

      Comment


      • #4
        Re: Need help recovering admin password in Windows 2000 Pro.

        Thanks a lot rvalstar, I appreciate all the info/help.

        Just a little question, I know this is far fetched and that there are security features in place to prevent this, but would there be any way to Access the SAM file to change the hash for a user with another hash of which I would know the password? (like is I know the hash for 12345 could I replace the current password hash for a user with the one I know)

        Another thing, would it be possible through the registry or SAM file to add a user being logged in from another machine or simply as the SYSTEM Account?
        I know in linux I could manually add an entry to the passwd file, I'm sure windows is much more complexe, but is it do-able?

        I'll probably do what you told me in submitting the hash and waiting 2 days to get the password, but in the mean time trying to find a way where I could get around this and have it done sooner.

        Again, thank you for all the help, much appreciated.

        Comment


        • #5
          Re: Need help recovering admin password in Windows 2000 Pro.

          BlueD,

          You can also download a Utility iso image known as REMOVED BY MOD CD. There is a Password recovery tool contained in it that will allow you to recover the passwords. Simply create a CD from the .iso file and boot to the CD. Then run the Recovery tool and it will allow you to resolve your issue.
          Last edited by rvalstar; 1st March 2007, 14:35. Reason: Appears to contain unlicensed bootleg software.

          Comment


          • #6
            Re: Need help recovering admin password in Windows 2000 Pro.

            @pmullan:

            I did a quick search on that CD you mentioned. Came to a site that I believe is the correct one. This site indicates the CD contains tons of software from commercial concerns (not freeware).

            Therefore I can only surmise this is an illegal CD.
            Cheers,

            Rick

            ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

            2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

            Comment


            • #7
              Re: Need help recovering admin password in Windows 2000 Pro.

              Originally posted by BlueD View Post
              Just a little question, I know this is far fetched and that there are security features in place to prevent this, but would there be any way to Access the SAM file to change the hash for a user with another hash of which I would know the password? (like is I know the hash for 12345 could I replace the current password hash for a user with the one I know)

              Another thing, would it be possible through the registry or SAM file to add a user being logged in from another machine or simply as the SYSTEM Account?
              I know in linux I could manually add an entry to the passwd file, I'm sure windows is much more complexe, but is it do-able?
              I'm sure both would be possible if you knew enough about the internals.

              The first bit is probably what #2 and #4 do here:

              http://www.petri.com/forgot_administrator_password.htm

              You could give them a try. I'd do an offline backup of C:\WINDOWS\system32\config first (as a slave drive or from a BartPE disk or ???)

              Haven't tried either so caveat emptor.

              Nor have I seen an offline tool to add accounts (maybe one of the previously mentioned tools?)
              Cheers,

              Rick

              ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

              2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

              Comment

              Working...
              X