powered by PmWiki |
MSTips /
LostPasswordTable of ContentsReset the Local (Machine) Administrator Password on a Windows NT4 and Windows 2000 ProfessionalUse the Offline NT Password & Registry Editor disk to reset the MACHINE Administrator password to "no password". Download Here How to make the floppyThe unzipped image (bdxxxxxx.bin) is a block-to-block representation of the actual floppy, and the file cannot simply be copied to the floppy. Special tools must be used to write it block by block.
If more details are needed please visit http://home.eunet.no/~pnordahl/ntpasswd/ Reset the Local (Machine) Administrator Password on a Windows XPHow to Reset the Built in Administrator's Password in case you have forgotten itThe Built-in Local Administrator account logon option appears only in Safe mode if more than one account is created on the system. The Administrator account is available in Normal mode only if there are no other accounts on the system. To work around this behavior, reset the password in the Local Users and Groups snap-in in Microsoft Management Console (MMC) as follows:
How to Create a XP password reset disk
The password reset disk contains only one file called userkey.psw, which is an encrypted version of your password. If you change your password, you must repeat this procedure. Use a limited accountIf you logged on to the computer by using a limited account, follow these steps to create a password reset disk for your user account:
Note If your user account does not have a password, do not type a password in the Current user account password box. How to use the XP password reset disk
Windows XP Professional in a domain1. Restart the computer. 2. In the Welcome to Windows dialog box, press CTRL+ALT+DELETE. 3. In the Log On to Windows dialog box, click OK. 4. In the Logon Failed dialog box, click Reset, and then click Next. 5. Insert the password reset disk into drive A, and then click Next. 6. Type a new password in the Type a new password box, and then type the password again in the Type the password again to confirm box. 7. In the Type a new password hint box, type a hint for the password, and then click Next. 8. Click Finish, and then try to log on to Windows XP again.[5] Reset the Local (Machine) Administrator Password on a Windows VistaHow to create a Vista password reset diskIf you forget your user account password, you can use a password reset disk to create a new password. Create a password reset disk so that you are prepared if you forget your password. By using a password reset disk, you can avoid losing access to the files and to the information on your computer. NOTE: The Local or Machine Administrator password is the same for either Recovery Console or Directory Service Restore Mode''' You cannot use a password reset disk to reset the password for another computer. Warning A third-party can access your computer by using a password reset disk. Therefore, it is important to store the disk in a safe location. To create a password reset disk, you must have writable removable media, such as a floppy disk or a USB flash drive. To create a password reset disk, follow these steps:
To use the password reset disk and the Password Reset Wizard to log on to the computer, follow these steps:
The Above Applies to:
Reset the Local (Machine) Administrator Password on a Windows 2000Use the Offline NT Password & Registry Editor disk to reset the MACHINE Administrator password to "no password". Download Here How to make the floppyThe unzipped image (bdxxxxxx.bin) is a block-to-block representation of the actual floppy, and the file cannot simply be copied to the floppy. Special tools must be used to write it block by block.
If more details are needed please visit http://home.eunet.no/~pnordahl/ntpasswd/ Reset Domain Administration Password in Windows 2000 Domain Controller (W2K DC)NOTE: The Local or Machine Administrator password is the same for either Recovery Console or Directory Service Restore Mode Method 1If Windows 2000 Service Pack 2 or later is installed on your computer, you can use the Setpwd.exe utility to change the SAM-based Administrator password. To do this:
Method 2
net user administrator *
6. Shut down and restart the computer. 7. You can now use the Administrator account to log on to Recovery Console or Directory Services Restore Mode using the new password. NOTE: If you make a mistake, repeat these steps to run setpwd again. For additional information about the Setpwd.exe utility, click the article number below to view the article in the Microsoft Knowledge Base: 271641 The Configure Your Server Wizard Sets Blank Recovery Password For additional information about how to secure the local SAM, click the article number below to view the article in the Microsoft Knowledge Base: 223301 - Protection of the Administrator Account in the Offline SAM Method 3"Directory Service Recovery Mode" uses MACHINE level account. The following method can be used to reset the DC administrators password: 1. Use the Offline NT Password & Registry Editor disk to reset the MACHINE Administrator password to "no password". HKEY_USERS\.Default\Control Panel\Desktop 6. Write down or print screen the default values BEFORE changing them or backup the values to a .REG file by selecting the DESKTOP key and then selecting EXPORT from the FILE menu. SCRNSAVE.EXE - change from logon.scr to cmd.exe
ScreenSaveTimeout - change from 900 to 15
ScreenSaveActive - change to 1 (if it wasn't 1 already)
8. Reboot normally. When the box appears asking you to select CTRL-ALT-DEL to log in, just wait. After 15-30 seconds you will see a command prompt appear (since that is the screensaver). MMC DSA.MSC NOTE: The Local or Machine Administrator password is the same for either Recovery Console or Directory Service Restore Mode''' DSA.MSC is actually the executable name for Active Directory Users and Computers, which in turn is the main tool for managing users, groups and computers in Windows 2000 Active Directory. 10. This should bring up the management console where you can edit users' passwords, including the password for the Administrator account. Method 4SUMMARYEach Windows-based computer maintains a machine account password history containing the current and previous passwords used for the account. When two computers attempt to authenticate with each other and a change to the current password is not yet received, Windows then relies on the previous password. If the sequence of password changes exceeds two changes, the computers involved may be unable to communicate, and you may receive error messages (for example, "Access Denied" error messages when Active Directory replication occurs). This behavior is also applicable to replication between domain controllers of the same domain. If the domain controllers that are not replicating reside in two different domains, you should inspect the trust relationship more closely. You cannot change the machine account password using the Active Directory Users and Computers snap-in, but you can reset the password using the Netdom.exe tool included in the Windows Support Tools. The Netdom tool resets the account password on the computer locally (known as a "local secret") and writes this change to the computer's computer account object on a Windows domain controller that resides in the same domain. Simultaneously writing the new password to both places ensures that at least the two computers involved in the operation are synchronized, and starts Active Directory replication so that other domain controllers receive the change. The following procedure describes how to use the netdom command to reset a machine account password. This procedure is most commonly used on domain controllers, but also applies to any Windows machine account. Because you cannot use Netdom remotely, you must run the tool from the Windows-based computer whose password you want to change. In addition, you must have administrative permissions locally and on the computer account's object in Active Directory to run Netdom. How to Do ItUsing Netdom to Reset a Machine Account Password 1. Install the Windows Support Tools from the Support\Tools folder on the Windows CD-ROM on the domain controller whose password you want to reset. 2. If you are attempting to reset the password for a Windows domain controller, it is necessary to stop the Kerberos Key Distribution Center service and set its Startup type to Manual prior to continuing with step 3. Note:' After you restart and verify that the password has been successfully reset, you can restart the Kerberos Key Distribution Center service and set its Startup type back to Automatic. Doing this forces the domain controller with the bad computer account password to contact another domain controller for a Kerberos ticket. 3. At a command prompt, type the following command: netdom resetpwd /server:Replication_Partner_Server_Name /userd:domainname\administrator_id /passwordd:* where Replication_Partner_Server_Name is the fully qualified DNS or NetBIOS name of a domain controller in the same domain as the local computer, and domainname\administrator_id is the NetBIOS domain name and administrator ID respectively, in the Security Accounts Manager (SAM) account name credentials format. The "*" value to the /PasswordD: parameter specifies that the password should be typed using hidden characters when the command is submitted. For example, the local computer (which happens to be a domain controller) is Server1 and the peer Windows domain controller name is Server2. If you run Netdom on Server1 with the following parameters, the password is changed locally and is simultaneously written on Server2, and replication propagates the change to other domain controllers: netdom resetpwd /server:server2 /userd:mydomain\administrator /passwordd:* 4. Restart the server whose password was changed (in this example, Server1). APPLIES TO
Reset the Local (Machine) Administrator Password on a Windows 2003 DC (W2K3 DC)Method 1NOTE: The Local or Machine Administrator password is the same for either Recovery Console or Directory Service Restore Mode To change the Directory Service Restore Mode Administrator password use the following method:
You can now use the Administrator account to log on to Recovery Console or Directory Services Restore Mode using the new password. NOTE: This section describes how to reset the Directory Services Restore Mode (DSRM) administrator password for any server in your domain without restarting the server in DSRM. Microsoft Windows 2000 uses the Setpwd utility to reset the DSRM password. In Microsoft Windows Server 2003, that functionality has been integrated into the NTDSUTIL tool. Note that you cannot use the procedure that is described in this article if the target server is running in DSRM. A member of the Domain Administrators group sets the DSRM administrator password during the promotion process for the domain controller. You can use Ntdsutil.exe to reset this password for the server on which you are working, or for another domain controller in the domain. Method 2SUMMARYThis step-by-step article describes how to use Netdom.exe to reset machine account passwords of a Windows Server 2003 domain controller. Each Windows-based computer maintains a machine account password history that contains the current and previous passwords that are used for the account. When two computers try to authenticate with each other and a change to the current password is not yet received, Windows relies on the previous password. If the sequence of password changes exceeds two changes, the computers involved may not be able to communicate, and you may receive error messages. For example, you may receive "Access Denied" error messages when Active Directory replication occurs. This behavior also applies to replication between domain controllers of the same domain. If the domain controllers that are not replicating reside in two different domains, look at the trust relationship more closely. You cannot change the machine account password by using the Active Directory Users and Computers snap-in, but you can reset the password by using the Netdom.exe tool. The Netdom.exe tool is included in the Windows Support Tools. The Netdom.exe tool resets the account password on the computer locally (known as a "local secret") and writes this change to the computer's computer account object on a Windows domain controller that resides in the same domain. Simultaneously writing the new password to both places ensures that at least the two computers involved in the operation are synchronized, and starts Active Directory replication so that other domain controllers receive the change. How to do itThe following procedure describes how to use the netdom command to reset a machine account password. This procedure is most frequently used on domain controllers, but also applies to any Windows machine account. You must run the tool locally, from the Windows-based computer whose password you want to change. Additionally, you must have administrative permissions locally and on the computer account's object in Active Directory to run Netdom.exe. Back to the top Use Netdom.exe to Reset a Machine Account Password 1. Install the Windows Server 2003 Support Tools on the domain controller whose password you want to reset. These tools are located in the Support\Tools folder on the Windows Server 2003 CD-ROM. To install these tools, right-click the Suptools.msi file in the Support\Tools folder, and then 2. If you want to reset the password for a Windows domain controller, you must stop the Kerberos Key Distribution Center service and set its startup type to Manual. Notes After you restart and verify that the password has been successfully reset, you can restart the Kerberos Key Distribution Center (KDC) service and set its startup type back to Automatic. This forces the domain controller that has the incorrect computer account password to contact another domain controller for a Kerberos ticket.
3. Remove the Kerberos ticket cache on the domain controller where you receive the errors. You can do this by restarting the computer or by using the KLIST, Kerbtest, or KerbTray tools. 4. At a command prompt, type the following command: netdom resetpwd /s:server /ud:domain\User /pd:* A description of this command is:
5. Restart the server whose password was changed. In this example, this is Server1. APPLIES TO
Reset Domain Administration Password in Windows 2003 Domain Controller (W2K3 DC)NOTE: The Local or Machine Administrator password is the same for either Recovery Console or Directory Service Restore Mode Requirements
Once the above requirements have been met, do the following:
Run "regedit". Navigate to HKEY_USERS\.Default\Control Panel\Desktop and change the following values:
C:\WINNT\system32> NET USER ADMINISTRATOR newpassword Once you enter this command, you should be able to exit from the command prompt, hit CTRL-ALT-DELETE, and log into the domain Administrator account using the new password. Again, without a Windows server I have no way to verify that this does or does not work, so I would appreciate any feedback from people who have tried this and can tell me that it does or does not work with their particular version of Windows.
C:\WINNT\system32> MMC DSA.MSC This should bring up the management console where you can edit users' passwords, including the password for the Administrator account. If you type this command and it doesn't work, wait 30 seconds and try it again. This happened to me, it sounded like it was still in the process of loading drivers into memory in the background... If this doesn't work after waiting the 30 seconds... realize that THIS IS A COMMAND PROMPT WITH FULL DOMAIN ADMINISTRATOR RIGHTS, and you're running a command ("MMC.EXE") with another filename ("DSA.MSC") as an argument. If it "just plain doesn't work", maybe you need to locate these two files and type them in as full path names. Maybe something like "C:\WINNT\SYSTEM32\MMC.EXE C:\WINNT\SYSTEM32\DSA.MSC". Type the word EXPLORER and hit ENTER, to get a full deskop with Administrator rights. From there, they should be able to find the right program on the start menu- usually Start, Programs, Administrative Tools, Active Directory Users and Computers. Thanks, Joe!
Password Recovery Tools
References 1. ^ jms1.net - Retrieved on 21 August 2007 Additional ReadingKnowledge Base# 322672 - How To Reset the Directory Services Restore Mode Administrator Account Password in Windows Server 2003 All text is available under the terms of the GNU Free Documentation License |