Announcement

Collapse
No announcement yet.

System Admin got fired and changed the domain admin password

Collapse
This topic is closed.
X
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • System Admin got fired and changed the domain admin password

    Hi,


    as stated i am the new system admin, the domain controller is a windows 2000 server. the scenario is he got fired and did not turned over anything. now i am on wits end having not knowing the local administrator and domain administrator account. he may still be controlling the servers remotely because some employees cannot log-in anymore, some have been denied with their internet access and i tried doing the instructions found here:

    http://www.petri.com/reset_domain_ad...ws_2000_ad.htm

    but there was a small problem.. the software cant detect the scsi drives. it is plugged into a DELL CERC ATA 100 4ch Raid Controller.

    i would really appreciate it if you could give me a link on where i can find that ".KO" file so i could include it on the drivers.zip.

    or does anybody has a work around for this?

    Thanks in advanced.
    Last edited by Apocalynx; 26th January 2008, 11:57.

  • #2
    Re: System Admin got fired and changed the domain admin password

    anybody?

    by the way... i can log in on any servers and to the domain controller using an ordinary user account...

    Comment


    • #3
      Re: System Admin got fired and changed the domain admin password

      Really poor quality of service these days... no reply for NEARLY THREE HOURS, and on a weekend as well

      Apocalynx, give us a chance. We have real lives too.
      Did you research the issue, and did give you this link which may help
      http://ubcd4win.com/forum/index.php?...ded&show=&st=0

      Have you checked if your "ordinary user account" has permission to change the administrator's password?

      Do you know the old admin password -- you could try booting into directory services restore and seeing if that works -- IIRC that never updates.
      Tom Jones
      MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
      PhD, MSc, FIAP, MIITT
      IT Trainer / Consultant
      Ossian Ltd
      Scotland

      ** Remember to give credit where credit is due and leave reputation points where appropriate **

      Comment


      • #4
        Re: System Admin got fired and changed the domain admin password

        hahaha.. thats alright ossian.. thank you by the way for replying..


        the ordinary user accounts has no permission to anything...

        have no luck with google...

        thanks for the link by the way..

        will read it now...

        i'm in a desperate move right now... thanks again...

        Comment


        • #5
          Re: System Admin got fired and changed the domain admin password

          just an update

          i have tried the ERD Commander 2005 was able to reset the local admin password of all the other Servers (2000 and 2k3) except for the Domain Controller. apparently the ERD commander can only reset the password of the user "Administrator" but for the case of my domain controller the "administrator" user was renamed.

          also, using the ERD commander.. i have tried to rename CMD.EXE to Logon.scr
          and renamed the original logon.scr to logon.scr1.. but it seemed it has no effect since the ERD was not the local admin.

          so my another question is.. Is there any work around using my other servers with local admin rights?

          Thanks

          Comment


          • #6
            Re: System Admin got fired and changed the domain admin password

            Another update

            i was able to reset the local admin woth ACTIVE PASSWORD CHANGER 3.0.

            i can now able to log in as a local admin using the directory service mode. but when i got it into reg edit, the ScreenSaveActive and ScreenSaveTimeOut cant be found in the .default settings. i tried to make a copy of the strings but it cant be saved, so what i just did was replaced the ScreenTimeOut to 15 and SCRNSAVE.EXE to CMD.EXE.

            rebooted the machine, waited for 15 seconds, then the command windown appears but closes immediately as if it was refreshing the page. same thing happens every 15 seconds.

            also the log in locally is disabled by the domain policy so i cant use my local admin on normal booting.

            Do you guys have another work around for this?

            Thanks

            Comment


            • #7
              Re: System Admin got fired and changed the domain admin password

              Hi Again.

              Got the Winkey Enterprise and used it.. and got this...


              Screen output
              -------------




              Windows Key Enterprise Edition 8.0 build 2596
              Copyright (C) 1998, 2007 Passware

              http:// www. LostPassword. com/
              e-mail: csupport @LostPassword. com

              Licensed to:
              Name: Seabiscuit
              Company: Dispo
              Serial No: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX EDITED BY MOD


              Please enter Windows Key access password you have setup
              during the installation. Press Enter when done:
              ********

              This computer program is protected by copyright law and international
              treaties. Unauthorized reproduction or distribution of this program
              is strictly prohibited.

              Found the following disk drives:
              C: \Device\Harddisk0\Partition1 FAT 32018Kb
              D: \Device\Harddisk0\Partition2 NTFS PUMP_Boot 10490444Kb
              E: \Device\Harddisk0\Partition3 NTFS NTDS_Drive 10482412Kb
              F: \Device\Harddisk0\Partition4 NTFS SYSVOL_Drive 10482380Kb
              G: \Device\Harddisk0\Partition5 NTFS Other_Drive 12586892Kb

              Searching for Windows installations...
              Checking drive C: no installations found
              Checking drive D:
              Found at: D:\WINNT
              Checking drive E: no installations found
              Checking drive F: no installations found
              Checking drive G: no installations found



              Please select Windows installation to be processed:


              # Path Undo available
              --- -------- --------------
              [1] D:\WINNT [X]

              Please enter your selection 1..1 or 0 to quit: [1]

              Processing Windows installation at D:\WINNT.
              Found undo information (Local Users Passwords and/or Active Directory Passwords)
              Would you like to undo Windows Key changes? (Y/N): N

              Active Directory backup requires 151 MB on your hard drive.
              Free space available: 5524 MB
              Continue with backup? (Y/N): Y

              winkey Error: Insufficient memory to perform the operation.

              You can free additional memory by closing
              other applications.
              Base:
              BFC76000
              Stack dump:
              BFCB7AC9
              BFCB7D68
              BFCADFC6
              BFCAD49F
              BFC7E09E
              BFC7D6FE
              BFC77344
              BFC81FD5
              BFC815F8
              BFC810B7
              BFC7FDD7
              BFC8E16A
              BFC8E59D
              BFD1D171
              8041D637
              804ADDB3
              804A5CC6
              804624E9


              Unexpected results were encountered while running the program. It is
              recommended to create a log file that can help our support team to reproduce
              the problem.

              Create the log file? (Y/N): Y


              End of log file
              Last edited by danielp; 4th February 2008, 09:31.

              Comment


              • #8
                Re: System Admin got fired and changed the domain admin password

                The serial number you so kindly posted above is visible on multiple warez sites so is NOT legal

                Petri does not allow or condone any use of illegal software.
                Post reported to forum moderators/admins and user infraction given
                Last edited by Ossian; 4th February 2008, 08:30.
                Tom Jones
                MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
                PhD, MSc, FIAP, MIITT
                IT Trainer / Consultant
                Ossian Ltd
                Scotland

                ** Remember to give credit where credit is due and leave reputation points where appropriate **

                Comment


                • #9
                  Re: System Admin got fired and changed the domain admin password

                  I'm closing this thread as it appears nothing productive can come from it.
                  Cheers,

                  Rick

                  ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

                  2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

                  Comment

                  Working...
                  X