Windows Password Recovery

() "HELP! Forgot my Windows password! WHAT DO I DO??" You crack it, of course.

August 13, 2007 1:32 AM ET in Articles, ,


Passwords are a fickle thing; they protect our intellectual and digital assets from unwanted intruders, but for those rarely-used passwords, they can slip fleetingly from memory leaving us locked out of our own goods. Of all the passwords out there, those for Windows accounts are perhaps the most ubiquitous, and therefore it is commonly exclaimed: “HELP! Forgot my Windows password! WHAT DO I DO??”

You crack it, of course. Luckily for the lot of us, Microsoft’s encryption for account passwords is mediocre at best, which leaves the end-user a significant quantity of traction in these matters. In order to proceed, the following materials are required:

  1. A secondary computer with a CD burner.
  2. The capability to successfully burn a bootable ISO.
  3. The fantastic NT Password Reset utility.

The year during which the project went dark has passed, and the 10-year anniversary edition from April, 2007 now works on any Microsoft product in the Windows NT-based family. Once you have this ISO burned to CD, reboot the computer and settle in for a bit of work at the CLI. Now all you have to do is follow this procedure step by step, and your NT password will be reset in no time:

Step 1: Starting the Tool

Just hit enter!

STEP1_booting_nt_password_reset.jpg

Step 2: Select the Partition

Where the program says “DISK /DEV/SDA: 320GB, 320071652352 BYTES,” below that is the partition with Windows on it as described by “1: /DEV/SDA1 5113MB BOOT.” When it says “Please select partition by number,” you would select the number that has been assigned to that partition. Remeber “1: /DEV/SDA1″ — So in this case, type “1″ and hit enter.

STEP2_select_reset.jpg

Step 3: Load the Registry

Now that the partition has been mounted, you will be prompted to select the location of your registry. As we can see at the bottom of the screenshot, [WINDOWS/SYSTEM32/CONFIG]” has been selected for us. Simply press enter.

STEP3_select_partition.jpg

Step 4: Choose to Edit Passwords

Here you will be prompted what you want to do with the utility now that you’ve loaded your computer’s Windows partition and registry. Press “1″ and hit enter to begin the password reset suite.

STEP4_select_editpasswords.jpg

Step 5: Select the Account to Reset

Accounts are identified with their “RID,” which is a four character HEX code preceded by “0x”. In this case we are resetting the password for the “TEST” account, which has an RID of 0×03EC. All you must do is type the RID of the account you want to reset and hit enter. I have done so for the 0×03EC “Test” account.

STEP5_select_RID.jpg

Step 6: Blank the Password

Now that you have the account loaded, type “*” and hit enter. This will blank the password for the account and leave you an account with no login protection. This is often the best procedure.

STEP6_blank_password.jpg

Step 7: Confirm and Quit

“Do you really wish to change it? (y/n) [n]” — The program is inquiring whether or not you’d actually like to change the password. Press “Y” to signify yes, and hit enter. At this point, you can also quit out of the password reset portion of the program by entering an exclamation point and hitting enter.

STEP7_password_changed.jpg

Step 8: Confirm Quit and Write Changes

Once you have entered the exclamation point, which exits you from your partition and registry editing, pressing “q” on the keyboard and hitting enter will prompt you to write the changes. “About to write file(s) back! Do it? [n] : ” — Hit “y” and then press enter. This will write the blanked account password back into the encrypted account database for Windows NT-based OSes.

STEP8_write_reset_back.jpg

Once you’ve written the changes back, you can remove the disc from your PC and reboot your machine. Getting back to the Windows login screen, you should be allowed to log right into your account with no password. This procedure, as a reminder, only works for Windows 2000, Windows XP, Windows Vista and Windows 2003; no other version of Windows is compatible with this boot disc. If you’re still running Windows 98 or Windows ME, pressing “Escape” at the login screen will give you complete access to the PC without login credentials. Good luck!


2 Comments:

  1. A Better Solution

    Just throw this live cd in and it preforms a dictionary attack on the weak lm/ntlm hash's (Since microsoft uses such a weak hashing scheme.. If they used MD5 like everyone else it would take a much bigger table).

    edit: The main benifit of this method of this method is you don't lose any encrypted files you may have had.

  2. Locking this thread to alleviate outrageous spam.

Troll-free since 2003 ®