Lost Passwords

From the April 2001 Edition
of Windows IT Pro
Readers
Reader to Reader
InstantDoc #20030
Windows IT Pro

People often find themselves locked out of their Windows 2000 or Windows NT systems as a result of a lost password for the Administrator account. Usually people consider the system a lost cause and start rebuilding it. However, you can use the following tip to work around this problem. When Win2K or NT boots, the OS usually displays the Ctrl+Alt+Del screen for approximately 20 minutes before the display changes and the logon box moves around the screen. When this happens, the machine has activated the screensaver logon.scr. If you replace this file with an alternative file (e.g., cmd.exe), the system will run this file under the system account instead of logon.scr. At this point, a user could issue a command such as Net User, usermgr.exe, or compmgmt.msc to reset the Administrator password.

—Darren Sykes
darren.sykes@energis-squared.com

End of Article

This is one of the best tricks I've heard of. Great Idea!!

Rich Kerr April 03, 2001

Just to clarify the process (as I've been asked this several time). The logon.scr file is found in %systemroot%\system32. To replace the file, you can take any of the following approaches: 

1) Use an NTFS reader/writer such as those available from sysinternals.
2) Transplant the disks to an alternate machine, make the modifications and move them back
3) Login as a regular user and make the changes, the files are not protected by default.
 
Oh, and don't forget to put the files back to their original state after you've reset the password!

Darren Sykes April 05, 2001

In the time it takes to complete this method I would have the sam copied to a floppy after booting with a win98 disk that has a copy of ntfsdos. L0pht would most likely be just finished cracking the password long before logon.scr ever kicked in.

Robert Reid April 17, 2001

well, I must agree its one of the best solutions.
 
I published this solution (known as solution #2) online in March of 1999.
 
I published my first solution online in June of 1997.
 
my url: www.compusmart.ab.ca/theclub/terrywas/winnt/winntpwd.htm

Terry Waskowich May 01, 2001

I was with Terry (waskowich) when he tested this on a P133 with just 120MB drive and I watched him do this at least two different ways. I suggest you give the original author the credit here.

Christopher Voss May 11, 2001

You don't need to do this, and you don't need to fork out the $250 for sysinternals NTFS Professional utility. Just check out <a href="http://home.eunet.no/~pnordahl/ntpasswd/index.html">http://home.eunet.no/~pnordahl/ntpasswd/index.html</a>. This guy made a utility that works perfectly, takes 25 seconds, works with any account, and is open source and free to download and use. Check it out, it saved me quite a headache and is going into my library of emergency tools.

Ryan Parr November 12, 2001

You must log on before posting a comment.

If you don't have a username & password, please register now.