By: Daniel Petri

Ok, so you say you forgot your Windows administrator's password, huh? Oh well, it doesn't really matter if you did or you just say you did. The fact is that you need to gain access to a computer and you cannot "remember" the administrator's password.

How can you get out of this situation without formatting and re-installing the operating system?

Well, you can always try to remember the login password, or if that doesn't work (you wouldn't be sitting here reading my crap if you did remember, would you?) you can restore a backed up System State (in W2K DC) or a ERD (in NT 4.0) in which you do remember the password. The problem with doing so is that you'll probably lose all of the recently add users and groups, and all the changed passwords for all of your users since the last backup was made.

Note: If you are looking for password cracking tools that can be used for miscellaneous objectives such as password-protected PDF documents, zipped archives, Office documents, BIOS protection and so on then this pages is NOT for you. See some links at the bottom of this page for hints on where to find such tools, but I can tell you right away that Google might be a better choice for you.

Free Tools

Free Windows password-cracking tools are usually Linux boot disks that have NT file system drivers and software that will read the registry and rewrite the password hashes for any account including the Administrators. This process requires physical access to the console and an available floppy drive but it works like a charm! I've done it myself several times with no glitch or problem whatsoever.

Here are three of these free tools:

1. Petter Nordahl-Hagen's Offline NT Password & Registry Editor

2. Openwall's John the Ripper

3. EBCD – Emergency Boot CD

4. Austrumi

If you happen to know about other free tools please let me know .

For Domain Admin password resetting procedures please see the Related Articles section at the bottom of this page.

Offline NT Password & Registry Editor (v040114)

Petter Nordahl-Hagen has written a Windows NT/2000/XP offline password editor:

http://home.eunet.no/~pnordahl/ntpasswd

• This is a utility to (re)set the password of any user that has a valid (local) account on your NT system, by modifying the encrypted password in the registry's SAM file.

• You do not need to know the old password to set a new one.

• It works offline, that is, you have to shutdown your computer and boot off a floppy disk or CD. The boot-disk includes stuff to access NTFS partitions and scripts to glue the whole thing together.

• Works with syskey (no need to turn it off, but you can if you have lost the key)

• Will detect and offer to unlock locked or disabled out user accounts!

Caution: If used on users that have EFS encrypted files, and the system is XP or later service packs on W2K, all encrypted files for that user will be UNREADABLE! and cannot be recovered unless you remember the old password again!

Download links:

• bd040116.zip (~1.1MB) - Bootdisk image, date 040116

• sc040116.zip (~1MB) - SCSI-drivers (040116) (only use newest drivers with newest bootdisk, this one works with bd040116)

• cd040116.zip (~2MB) - Bootable CD image with same version and drivers as floppies above.

To write these images to a floppy disk you'll need Raw Write, Win Image or any other writing software you want.

Support and Problems? Don't call me! Talk to the creator of this great tool. He also has a good FAQ set up covering most of the day-to-day questions. Read it right HERE

Author claims that this tool was successfully tested on NT 3.51, NT 4, Windows 2000 (except datacenter), Windows XP (all versions) and Window Server 2003. Notice that it is NOT compatible with Active Directory.

Need to change Windows NT/2000 Domain Admin password? This tool, however useful, will only reset the local administrator's password (e.g. the one found in the local computer's SAM). To reset a password of a domain administrator (or any other user for that matter) you must perform the routine that is described in the following page: Forgot the Administrator's Password? - Reset Domain Admin Password in Windows 2000 AD.

Note: This trick will probably not work under Windows Server 2003 due to service account security changes. To work around these limitations please read the Forgot the Administrator's Password? - Reset Domain Admin Password in Windows Server 2003 AD page.

John the Ripper (v1.6)

John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix flavors, supported out of the box are Kerberos AFS and Windows NT/2000/XP LM hashes, plus several more with contributed patches.

Read more at http://www.openwall.com/john/

Download links:

John the Ripper 1.6 (768kb)

EBCD – Emergency Boot CD (v0.60)

EBCD is a bootable CD, intended for system recovery in the case of software or hardware faults. It is able to create backup copies of normally working system and restore system to saved state. It contains the best system software ever created, properly compiled and configured for the maximum efficient use.

EBCD will be very useful when you need to:

• Copy/move files (with long names, not necessary in CP437 encoding) from/to the disk but OS which can handle them (windows, Linux...) cannot boot. In particular, you may create a backup copy of normally installed and configured Windows and later restore Windows from such backup copy. So, in the case of fault OS itself and all software and its settings can be restored in 5-10 minutes.

• Perform emergency boot of Windows NT / 2000 / XP. When the loader of this OS on the hard disk is damaged or misconfigured, you are able to load OS using another, standalone loader from this CD.

• Recover master boot record of HDD. This allows to boot OS after incorrect uninstallation of custom loader (LILO, for example), which made all OS on your PC not bootable.

• Delete, move, copy to file (image) and re-create partition from file. Image transfer over network is also supported: so you may configure one PC and then make contents of hard disks of other PCs same as contents of the hard disk of the first one.

• Change password of any user, including administrator of Windows NT/2000/XP OS. You do not need to know the old password.

• Recover deleted file, even file re-deleted from Windows Recycle Bin, and, in contrast, wipe single file or a whole disk so that it will be impossible to recover it in any way.

• Recover data from accidentally formatted disk. Sometimes it helps to recover data from the disk, damaged by a virus.

• Recover data from a floppy disk, which is not readable by OS. Format 3.5" disk for 1.7 Mb size.

Also the disk includes full set of external DOS commands, console versions of the most popular archivers/compressors.

Moreover, emergency boot CD includes minimal Linux distribution (Rescue Linux distribution) which may be very useful to a professional user.

Read more at http://ebcd.pcministry.com/

Download links:

EBCD Pro distribution (18mb)

Austrumi (v0.84)

Reader Cory Zerwas pointed out this tool. I haven't tested it myself, but from what I read about it it seems to do the job.

Austrumi is a Linux bootable ISO image for recovering NT passwords and other cool tools and methods, sized for Business Card size CD media (50Mb). It allows you to change any password, including that of the Administrator, on a partition occupied by Windows NT, Windows 2000 or Windows XP. Simply boot the CD and when you get to the initial boot prompt, type:

boot: nt_pass

This will launch a console utility that will detect Windows partitions on the hard disk and provide you with a menu to modify any user or Administrator passwords on the Windows system. It will even give access to the Windows registry for recovery purposes. Quite a handy utility to keep in your wallet (AUSTRUMI is small enough to fit on a business card-size CD) if you are unfortunate enough to having to deal with Windows machines in your line of work.

Read more at http://sourceforge.net/projects/austrumi

Download links:

Austrumi v0.84 (ISO file, 52mb)

Commercial Tools

Here are some of the commercial tools that will help you get out of the mess you're in. Make note that theses tools are not listed in any particular order:

• Lostpassword.com

• O&O BlueCon 2000

• Administrator's Pak and NTFSDOS

• LC4 - The Password Auditing and Recovery Application

• NTAccess 1.4

• Pwdump 3

• Windows XP/2000/NT Key

These tools cost money. Sometimes more than you think.

Other commercial password recovery tools (not administrator or OS related):

http://www.elcomsoft.com/prs.html

See this page that has links to lots and lots of password cracking tools (for Office, PDF, ZIP etc.):

http://www.openwall.com/PR

Note: I'd like to put together all the info you have about these issues. If you have any tips, recommended links or any ideas about how to figure out a lost password - please e-mail me and I'll get back to you .

Related articles

You may find these related articles of interest to you:

• Change Recovery Console Password

• Change User Password from a Remote Computer

• Change User Password from the Command Prompt

• Forgot the Administrator's Password? - Alternate Logon Trick

• Forgot the Administrator's Password? - Reset Domain Admin Password in Windows 2000 AD

• Forgot the Administrator's Password? - Reset Domain Admin Password in Windows Server 2003 AD

• What's the Password Reset Disk in Windows XP?

Links

Changing the Administrator password if you have forgotten it (Windows NT 4.0 only)

Lost your Administrator password and need the ultimate hack? (Windows NT 4.0 only)

Recover Lost Windows NT Administrator Password

Password Recovery Resources

up