I've put together a single floppy or CD which contains
things needed to edit the passwords on most systems.
The bootdisk supports standard (dual)IDE controllers, and most SCSI-controllers with the drivers supplied in a seperate archive below. It does not need any other special hardware, it will run on 486 or higher, with at least 32MB (I think) ram or more. Unsupported hardware: MCA, EISA, i2o may not work. Some newer IDE/SCSI-raid systems may not work either.
Tested on: NT 3.51, NT 4 (all versions and SP), Windows 2000 (all versions), Windows XP (all versions, also SP2), Windows Server 2003 (at least Enterprise).
DANGER WILL ROBINSON!
If used on users that have EFS encrypted files, and the system is XP,
all encrypted files for that user will be UNREADABLE!
and cannot be recovered unless you remember the old
password again
Please see the Frequently Asked Questions before emailing questions to me. Thanks!
Also take a look at Grenier's DOS port
How to fix it if you lost your admin password for your ActiveDirectory. Thanks to John Simpson.
Other ways to recover lost password etc at MCSE World
If you have the CD, all drivers are included. If you use the floppy, and you need the SCSI-drivers set, either prepare a floppy with the scsi-drivers .zip file unzipped (in \scsi), or put a selection of the drivers you need in the \scsi folder on the main floppy, there should be enough space for at least 4-5 drivers. In the latter case you don't need to carry around and swap floppies.
========================================================= . Step ONE: Select disk where the Windows installation is ========================================================= Disks: Disk /dev/ide/host0/bus0/target0/lun0/disc: 2147 MB, 2147483648 bytes NT partitions found: 1 : /dev/ide/host0/bus0/target0/lun0/part1 2043MB Boot Please select partition by number or a = show all partitions, d = load new disk drivers l = relist NTFS/FAT partitions, q = quit Select: [1]
Select: [1] d ==== DISK DRIVER / SCSI DRIVER select ==== You may now insert or swap to the SCSI-drivers floppy Press enter when done: Found 1 floppy drives Found only one floppy, using it.. Selected floppy #0 Mounting it.. Floppy selection done.. SCSI-drivers found on floppy: 1 BusLogic.o.gz 2 aic7xxx.o.gz 3 sym53c8xx.o.gz [ ... ] SCSI driver selection: a - autoprobe for the driver (try all) s - swap driver floppy q - do not load more drivers or enter the number of the desired driver SCSI driver select: [q]
SCSI driver select: [q] a [ BusLogic.o.gz ] Using /tmp/scsi/BusLogic.o PCI: Found IRQ 11 for device 00:10.0 [.... lots of driver / card info ...] scsi0: *** BusLogic BT-958 Initialized Successfully *** scsi0 : BusLogic BT-958 Vendor: FooInc Model: MegaDiskFoo Rev: 1.0 Type: Direct-Access ANSI SCSI revision: 02 [ ... ] Attached scsi disk sda at scsi0, channel 0, id 0, lun 0 SCSI device sda: 8388608 512-byte hdwr sectors (4295 MB) Partition check: /dev/scsi/host0/bus0/target0/lun0: p1 Driver BusLogic.o.gz loaded and initialized.
On the selected partition/disk, the main files for windows can theoretically be anywhere. And we must find the registry files to be able to edit them. There are however some usual places:
Selected 1 Mounting on /dev/ide/host0/bus0/target0/lun0/part1 NTFS volume version 3.1. Filesystem is: NTFS ========================================================= . Step TWO: Select PATH and registry files ========================================================= What is the path to the registry directory? (relative to windows disk) [windows/system32/config] : -r-------- 1 0 0 262144 Jan 12 18:01 SAM -r-------- 1 0 0 262144 Jan 12 18:01 SECURITY -r-------- 1 0 0 262144 Jan 12 18:01 default -r-------- 1 0 0 8912896 Jan 12 18:01 software -r-------- 1 0 0 2359296 Jan 12 18:01 system dr-x------ 1 0 0 4096 Sep 8 11:37 systemprofile -r-------- 1 0 0 262144 Sep 8 11:53 userdiff Select which part of registry to load, use predefined choices or list the files with space as delimiter 1 - Password reset [sam system security] 2 - RecoveryConsole parameters [software] q - quit - return to previous [1] :
We select 1 to edit passwords..
========================================================= . Step THREE: Password or registry edit ========================================================= chntpw version 0.99.2 040105, (c) Petter N Hagen [.. some file info here ..] * SAM policy limits: Failed logins before lockout is: 0 Minimum password length : 0 Password history count : 0 <>========<> chntpw Main Interactive Menu <>========<> Loaded hives: <sam> <system> <security> 1 - Edit user data and passwords 2 - Syskey status & change 3 - RecoveryConsole settings - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> 1 ===== chntpw Edit User Info & Passwords ==== RID: 01f4, Username: <Administrator> RID: 01f5, Username: <Guest>, *disabled or locked* RID: 03e8, Username: <HelpAssistant>, *disabled or locked* RID: 03eb, Username: <pnh>, *disabled or locked* RID: 03ea, Username: <SUPPORT_388945a0>, *disabled or locked* Select: ! - quit, . - list users, 0x<RID> - User with RID (hex) or simply enter the username to change: [Administrator]
Here you can enter the username you want to reset the password for. NOTE: It is case-sensitive, write it exact as listed (without the < and > of course)
Or if the name uses some characters that cannot be displayed, enter it's ID number (RID), like this: 0x1f4 would select administrator.
We select the default, which is administrator.
RID : 0500 [01f4] Username: Administrator fullname: comment : Built-in account for administering the computer/domain homedir : Account bits: 0x0210 = [ ] Disabled | [ ] Homedir req. | [ ] Passwd not req. | [ ] Temp. duplicate | [X] Normal account | [ ] NMS account | [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act | [X] Pwd don't expir | [ ] Auto lockout | [ ] (unknown 0x08) | [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) | Failed login count: 0, while max tries is: 0 Total login count: 3 * = blank the password (This may work better than setting a new password!) Enter nothing to leave it unchanged Please enter new password: *
Some information is displayed. Also, if the account is locked, you will be asked if you wish to unlock it (not shown here)
We go for the blank password option (*) WHICH IS HIGLY RECOMMENDED over setting a new one.
Please enter new password: * Blanking password! Do you really wish to change it? (y/n) [n] y Changed! Select: ! - quit, . - list users, 0x- User with RID (hex) or simply enter the username to change: [Administrator] !
! brings us back to the main menu here.
<>========<> chntpw Main Interactive Menu <>========<> Loaded hives:1 - Edit user data and passwords 2 - Syskey status & change 3 - RecoveryConsole settings - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> q
Hives that have changed: # Name 0- OK ========================================================= . Step FOUR: Writing back changes ========================================================= About to write file(s) back! Do it? [n] : y
THIS IS YOUR LAST CHANCE! If you answer y here there will be a write to disk!
Writing sam NOTE: A disk fixup will now be done.. it may take some time Mounting volume... OK Processing of $MFT and $MFTMirr completed successfully. NTFS volume version is 3.1. Setting required flags on partition... OK Going to empty the journal ($LogFile)... OK NTFS partition /dev/ide/host0/bus0/target0/lun0/part1 was processed successfully. NOTE: Windows will run a diskcheck (chkdsk) on next boot. NOTE: this is to ensure disk intergity after the changes ***** EDIT COMPLETE ***** You can try again if it somehow failed, or you selected wrong New run? [n] : n
That was all. The disk fixup is only run on NTFS filesystems, and will force chkdsk next time windows boots.
Please answer n here and then reboot, CTRL-ALT-DEL. Remember to remove the floppy or CD.
The most critical moment is when writing back the registry files to NTFS. Also, the file written back may be corrupt (from chntpw messing it up), preventing your NT system from booting properly. YOU HAVE BEEN WARNED! One indication of a corrupt SAM is that the Netlogon service will fail to start, which again means it's impossible to log in. Or it will simply just reboot forever.
Also, see the FAQ for help with common problems.
For linux-knowledged people, you may do things manually if the scripts fail, you have shells on tty1-tty4 (ALT F1 - ALT F4).
2004-08-18
9. aug 2004: (version 040116 and earlier) Some rather serious bugs have been discovered in the
allocation routines, which are used when adding or deleting values
or keys in the registry editor. In best case, they leak space,
in worst case, it may corrupt the file.
NOTE: This does not generally affect password changing, since password
reset just overwrites a few bytes in place, it does not reallocate space.
SUMMARY: Password edit OK. Regedit may not be. Expect new version out within a week or so.
040219:
Sorry, but the 040116 version seems to have a problem with keyboard on
some laptops (keyboard does not work). I do not have a fix for it yet.
040114:
Note: Some links may be offsite.
Previous version is 040116 and may sometimes be found here (also my site)
Mirror(s), in case you have problems getting the files from here.
I cannot guarantee that they are updated or that they havent changed
anything!
NOTE THAT THE BOOTDISK CONTAINS CRYPTHOGRAPHIC CODE, and that it may be ILLEGAL to RE-EXPORT it from your country.
The unzipped image (bdxxxxxx.bin) is a block-to-block representation of the actual floppy, and the file cannot simply be copied to the floppy. Special tools must be used to write it block by block.
Or from unix:
dd if=bd??????.bin of=/dev/fd0 bs=18k
Unzipped, there should be an ISO image file (cd??????.iso). This can be burned to CD using whatever burner program you like, most support writing ISO-images. Often double-clikcing on it in explorer will pop up the program offering to write the image to CD. Once written the CD should only contain some files like "initrd.gz", "vmlinuz" and some others. If it contains the image file "cd??????.iso" you didn't burn the image but instead added the file to a CD. I cannot help with this, please consult you CD-software manual or friends.
The CD will boot with most BIOSes, see your manual on how to set it to boot from CD. Some will auto-boot when a CD is in the drive, some others will show a boot-menu when you press ESC or F10/F12 when it probes the disks, some may need to have the boot order adjusted in setup.
Most of the stuff on the bootdisk is either GPL, BSD or similar license, you can basically do whatever you want with all of it, the sourcecode and licenses can be found at their sites, I did not change/patch anything.
However, the chntpw binary is (c) 2004 Petter N Hagen, and is restricted somewhat, see COPYING.txt Thus distribution of the floppy image is restricted by this if it contains that binary.
Stuff I used, big thanks:
