Administrative Password on XP

Yeah I've been to that site before, its like the first thing that shows up in a www.google.com search.  I didn't try anything past the first one because they all say NT, is that the same though for XP?

Mark

I went to this site and made the CD and tried it but I don't think it worked, I was in a rush so didn't get more time to research what was going on, just kept prompting me for:

DR-DOS A:\>

Or something like that, what am I supposed to do there, will that one work on XP Pro, its number two on the list you sent me.

http://home.eunet.no/~pnordahl/ntpasswd/

Mark

>>"I went to this site and made the CD "
I am assuming since you went this route you do not have XPhome???

>>"they all say NT, is that the same though for XP"
Yes they work for NT, 2000 & XP, basically PROfessional operating systems

>>"I was in a rush "
The professional versions of Windows are secure for good reasons. This is not a quick fix. As per the instructions "long text. Please read it all and the FAQ before mailing me questions"

I have not used that particular method, I use a Bart CD from   http://www.nu2.nu/pebuilder/    with a series of add-on tools, one of which will allow you to change the password. Nothing to spend a day learning how to create the CD, customize with a series of add-ons, and learn how to use it. But any of these methods are well worth spending the time as they will help you many times in the future.

Here is a good article that has more info
http://www.petri.co.il/forgot_administrator_password.htm
They list five free tools you can use. #5 is Austrumi, the one I have used several times. Once you know what you are doing it usually takes a few minutes to change the password.

Also, when you tried to do a repair on Xp, you went into the recovery console where it asked you for your password. Wrong move. Instead of choosing R for recovery console, choose install windows, it will then look to see if you already have a windows installation. Once it finds it, you can then choose to do a complete repair. It will install windows as a normal install but it will only repair the windows files, all your data wil still be on the disk.

Good Luck

  Please ignore the first paragraph, RobWill already posted that info. Sorry Rob

I would ask an admin to delete my response but I think the second half may help.

http://www.ultimatebootcd.com/  is a collection of handy system utilities, including this http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html offline password and registry editor for all windows versions, nt 3.51 and up.. including xp and 2003.

the ubcd is a must-have for anyone's toolbox or cd collection.

nltech,
Your link is the one being discussed above.

so the post comment window was sitting here for a few hours while i got called away.... when i started, there were zero comments. excuse me for posting a duplicate link.. it's never happened before in the history of ee. why waste another comment just to point it out?  :)

an additional point made is: why waste a cd on a 2mb one-timer when you can get other stuff (that everybody is bound to need at some point) too all integrated into one...

in addition, the boot disk on that page is one you state you've never used.. i have, it works for me every time... if you follow the detailed instructions on the 'bootdisk' page. in fact, provided that the over-the-top install being discussed didn't really screw things up, it could have been fixed in the time it took to type this in.

nltech,
I apologize if I have offended you.

Also, I am not suggesting Petter Nordahl-Hagen's password recovery method doesn't work, it is the probably the most popular method, simply saying I haven't used it, and most methods take a bit of work the first time you use them. You mentioned "it works for me every time", perhaps you can walk simpsons17371 through it.

Ok, I tried the second thing on that list, and I got some weird prompt that I can't figure out when I put the CD in, I used the last file on the list, the 3MB one, I figure the biggest would have everything I need on it, I don't have a floppy drive on this computer but there is one on the one I'm trying to get the password for, but I can get a floppy disk, I just prefer CD because its easier from where I am.  The prompt I got I can't remember, it was something along these lines, I know the directory was the A drive, and that I couldn't get it to change:

DR-DOS A:\>

The site was:

http://home.eunet.no/~pnordahl/ntpasswd/

I also tried the Austrumi but that doesn't seem to work, the computer just ignores the disk it seems, I know I burned it on there as an image and its an .ISO file, I used Nero, which I've done tons of times and know it works.  It just ignores it and starts to boot up, and do I need Linux/Unix to use that program, it said it was a Linux thing for recovery a NT password, I don't have Linux, will it work?

Alright, I think thats everything, I tried the www.loginrecovery.com site as well, and that didn't work, I'm just going to keep trying everything on the list until one works and I don't know what to do if it doesn't.

Mark

if your interested , i have something called Rainbow tables compiled on my machine.
send me your "SAM" file to my email and i will get the pasword for you.
i wont post it in public, i will send it to your email.
the sam file is under C:\WINDOWS\system32\config

my email is osamahamzah@hotmail.com

i might be able to crack it.

all the luck.

Hello again,

I noticed Assom-XP mentioned rainbow tables, I am also familiar with these, but I didn't want to cover those in the aspect of my last procedures.  Once you have acquired your sam and system file, I have access to 442,400 Gb of rainbow tables, a very hefty amount which many people don't have.  I can have your password ran through, and see if there isn't any luck.   If you choose to accept this method, please e-mail me your sam and system files to my public e-mail address spamserious@gmail.com - once you e-mail me, I will forward you my personal e-mail address as well as the results/status of the operation.

T-Snipez

sheesh T-Snipez , what kind of Harddisk you have :)
442,400 Gb of Rainbow tables :)
Enjoy it man :)

Assom-XP,

I wish it were all my space ;)
It's a distributed private project in which I have access to, wish I could tell you more but then I'd have to kill you.
Just kidding, but due to public abuse reasons I'm not supposed ot disclose the location of the online project, but if you're nice to me maybe I'll drop you a line.

T-Snipez

Whats the best way to get the SAM file, and the quickest, I can try that, but just for clarification, am I supposed to save an .ISO onto a disk as a Data thing or as an image, doing it as an image makes it boot automatically right? Thats what I did and none of the disks seem to boot, they just sit there and are ignored.

Also, you have 432 TB of space, WHAT!?!?!  I mean, sure if its a public project and a bunch of things put together, that just takes up space, thats like an entire room of harddrives wired together, lol.

Thanks for help.

Mark

when you booted with that floopy or CD u mentioned , where u able to access your harddisk?
i mean if u typed c:
if that worked then just move to your c:\windows\system32\config folder
there will be a file named SAM
that is what u want.

Hello simpsons17371

Think of a .iso file as a compressed cd that has all the files, folders, etc. in one file; the .iso file. However, to burn a .iso file you have to use a program to burn it directly, not put the .iso on a CD. You mentioned you used Nero, to burn a .iso file using nero I would suggest you follow these steps:

   1.  Launch Nero.
   2. Choose Recorder / Burn image
   3. Browse to the location of the ISO file and select the ISO file you want to burn to cd/dvd
   4. Check the option "Finalize CD (No further writing possible!)
   5. Click on "Burn" now.

Those steps are for Nero 6, if you have an older version, I suggest you refer to this guide for Nero 5.x instructions http://iso.snoekonline.com/iso.htm#Nero%20Burning%20ROM

Good Luck,
T-Snipez

Hello again,

You wanted to know the fastest and quickest method of getting the SAM file. I must urge you to not forgot the SYSTEM file, as it will also help you.  There are quicker floppy, dos-based ways of getting the SAM file but they are all command line, and so many things can go wrong - it's something you only want to do if you have free time.  Knoppix on the other hand, is very user-friendly, has a graphic-user-interface and supports ntfs as well as fat32 partitions.  That is why I recommend Knoppix over a command-line floppy based alternative.

Hope that helps,
T-Snipez

i dunno about sending registry hives to unknowns... ;)


at any rate. i did do a walkthrough for you, using the ultimatebootcd 3.3 basic as downloaded today from http://www.ultimatebootcd.com/

i don't have any "typical" xp pro installs (they're all goofy dual/triple boots), and the only xp home system here that is an only os is in use. so i had to use my xp home sandbox i have set up in virtual pc.. does not matter xp home or xp pro, does not matter i'm running a virtual pc instead of actual hardware. the program all works the same regardless... running in vpc allowed me to capture the screenshots needed to illustrate the process...

here it is. there's about a dozen screenshots all in a column.. so the image is pretty large. the only way i could get it all in one shot. notes are provided in the margin of the image next to each screen capture. but in case someone reads this later on and the image isn't available; a text walkthrough follows.

http://img128.imageshack.us/my.php?image=xppassrecovery2su.gif


1. obtain and burn to cd, the ultimatebootcd 3.3 (or other boot media with this tool on it http://home.eunet.no/~pnordahl/ntpasswd/ )

2. boot to the ultimatebootcd (or other media....)

3. in ubcd 3.3, the tool is in filesystem utilities (f3) on the second page (right arrow) and is the 6th one listed (f6)
offline nt password & registry editor 050303

4. select partition containing windows installation. a single installation on the first partition of the first drive (the "typical" installation of winxp) would be: 1

5. select location of windows registry files. should default correctly to:
windows/system32/config

(note this tool boots to a linux operating system so the slashes are backwards from msdos/windows)

6. what do we want to do? 1 for password resets

7. what do we want to do? 1 for user data and password edits

8. type the username of the account to edit. should default to administrator, so enter will suffice (defaults are within []'s throughout)

9. type in a single astrix/star/shift 8 (en-us keyboards)...:   *
to blank the password (recommended method.. then boot to windows and change it to something you'll remember)

10. confirm change then enter a bang/exclaimation to quit...:    !

11. then q to quit again... then confirm y to commit changes...

then reboot into windows... safe mode if winxp home edition.. login as 'administrator' (or the account you blanked the password on) with NO (a null) password....

Hello again,

nltech >>
I don't understand why you think having him send us the SAM and SYSTEM is a bad thing if we can get the pass a hell of a lot faster than he ever can.  Also, your solution by resetting a user's or administrator's password might cause data loss, especially EFS-encrypted files and saved passwords from within Internet Explorer. That's why I particularly don't endorse that kind of a solution.

Not tryin to make any enemies, but I hope that helps.

T-Snipez

One more thing,

Simpsons17371 doesn't have to send anybody the SAM and SYSTEM files if he chooses not to, he can always just use the original procedure that I suggested and use LCP to do all the work.  The only reason I suggested that he could send them to me was because Assom-XP or I could get the job done quickly and efficiently with rainbow tables, rather than brute forcing the password.  Not to say that LCP is not a good alternative, it is very much so, but it was an optional idea that he could send us the SAM and SYSTEM files to let us have a go at it.

Good Luck,
T-Snipez

What would the SAM file look like if I were to grab it and open it up somehow, would it look like what I got when I used the site www.loginrecovery.com because I still have that, I'll type it here for all of you guys.

Administrator:500:18,94,1D,7B,DC,81,59,65,3A,0F,64,36,AF,F3,88,1F:
_,C7,37,A2,F7,45,5C,D8,3D,1E,5B,76,D4,EC,0A,5A,03071D9:::

Thats exactly how it looked when I got it on the screen, the underscore was the first part of the second line.  So on the original list of 5 things which can be found at http://www.petri.co.il/forgot_administrator_password.htm that always shows up when you do a google scan, I did number 1 to no prevail, and I tried number 2, 4, and 5 and they all stopped at the same point, like they were the exact same program.  They get to a prompt where I can do standard stuff like in Command Prompt, but I have no access to anything and I can't get to the hard drive at all, says its not found, so I can't attempt to get the SAM file that way, the prompt is:

DR-DOS A:\>

Now, other things have been mentioned, such as:

http://www.nu2.nu/pebuilder/           --I have not yet tried this one, looked like there were way too many possibilities with it I think
http://www.ultimatebootcd.com/       --Didn't get a chance to try this one either, but I can try these soon, I've tried everything else I think
http://csociety-ftp.ecn.purdue.edu/pub/knoppix/KNOPPIX_V4.0.2CD-2005-09-23-EN.iso  --Didn't try Knoppix yet either, but can do that as well

Alright, so what do you think I should do, is that thing I just posted, what looks like a bunch of hex code, the SAM file opened up, because if it is I can just use that to get the user accounts and passwords with that program you posted right T-Snipez?

This has got to be one of the hardest and seemingly longest tasks I've ever done to fix a computer, lol.

Mark

Hi Mark,

I've been messing around with that stuff that the LoginRecovery spit out, and I'm not sure what to consider.  If I am reading it, which I have no way of knowing if I am, then it may be telling us the following information:

Account Name: Administrator
LM Hash: 18941D7BDC8159653A0F6436AFF3881F
NT Hash: C737A2F7455CD83D1E5B76D4EC0A5A03071D9

Now I am not certain if I read any of that correctly, but we know these facts:
Login Recovery does NOT get information from the SYSTEM file that tells us a lot about the password.
Login Recovery may or may not use a special format/encryption technique to wrap the windows password in.

If I did read the LM Hash correctly, I'm having it cracked right now, but I'm not sure if I even did.  I also don't know where it is more or less than 8-12 characters, the SYSTEM file helps us with this information.  What it basically gets down to, is you're best bet is to with some method, I recommend using Knoppix, get the SYSTEM and SAM files off the harddrive. LoginRecovery simply does not provide us with enough information.

Good Luck,
T-Snipez

Back again,

I noticed the site to download Knoppix was a little slow from the link I gave you, if you are experiencing troubles I suggest you try this one:

ftp://ftp.kernel.org/pub/dist/knoppix/KNOPPIX_V4.0.2CD-2005-09-23-EN.iso

Hope that helps,
T-Snipez

Alright, I will try the Knoppix way, finally I won't be wasting a disk on like a 3MB file, man that was annoying, because for the first 3 disks I made I made them not bootable, but just as data disks, and now I have 3 more that just don't do the job, and all have less than 50 MB of space taken up, lol, good thing they are like 10,000 for a buck.

I hope this way works, lol.  Seems like it will, how long do you think the process takes for it to "Audit" what the code is or whatever, and, after I put the stuff on a blank floppy, do I have to take it off the floppy to make it properly read the SAM and SYSTEM file, or can I take it off, because I just realized, while typing this sentence actually, that I don't have a floppy drive on this computer, so I would put it on a different one, then send it over AIM or something to this computer, because I hate using computers that aren't mine.

I hope this thread is coming to a close soon, lol, thanks for all the help, I'll post back by about 8PM EST time on how it went.

Mark

Hello simpsons17371,

I'm afraid that I must too be gone for a little while, and won't be back for a couple of hours.  Within knoppix, there is a program called GAIM that will allow you to use AIM or whatever service (MSN, Yahoo, etc) to send the SAM and SYSTEM files to another computer.  You could also just use the built-in firefox, access your e-mail, and send the files.  There are many options, and knoppix is full of programs.  It also has somthing called Samba to network itself with Windows computer networks.  You could still always stick with the floppy idea, and if you do, you will want to copy the contents of the floppy to the harddrive for faster reading.  Well good luck, I'll be back later if you experience any more problems.

Cheers,
T-Snipez

Yeah, I think I experienced more problems, is there something I'm missing that is so important that I can't get anything done.  The same thing happens when I put in Knoppix CD as the others, tries to boot something up and I end up with a final command prompt that says:

[DR-DOS] A:\>

And when I do stuff like "dir" to see whats in the directory, its the same files as on the other 3 disks, and when I do "cd C:\WINDOWS\System32\config" it will say directory not found, and when I do "copy C:\WINDOWS\System32\config\SAM (or SYSTEM)" it just tells me that drive A can not be written to or something, and to either Abort, Retry, or Fail.

How come all the disks, although they seem different and claim to be different end up being the exact same thing for me everytime?

When I start the computer up with the disk in and stuff, what is a set of commands I should be able to follow to quickly get the SAM and SYSTEM file, since I don't seem to be able to figure this out myself.

Mark

Hi Mark,

How are you burning the .iso file? Did you follow the instructions I gave you for Nero? If you continue experiencing trouble, I recommend you use the 30 day trial of Alcohol 120% available from:
http://www.download.com/Alcohol-120-/3000-2646-10158124.html?part=dl-Alcohol120&subj=dl&tag=button
After you've installed it, just run the image burning wizard and it should be cake.

Good Luck,
T-Snipez

Alright, I think I finally got something going for me, I got Knoppix to work, see I was not burning stuff as images everytime, but as a bootable CD which is an option with the Nero I have, so I tried with the image and it worked.

Now, of course, when I figure one thing out more problems arise, the SYSTEM file is too big for the floppy disk, only the SAM file can fit on, and the SYSTEM file is about twice as big as any other empty floppy disk.  So I thought I could just mail it to myself online, but I can't get connected at all because the computer only has a dial up connection and I use a cable thingy and wireless, so my cable fits no where in the computer ports, so I have no internet.  I tried using a random thumb drive USB key thing I found, but it doesn't ever seemed to be recognized or anything.  Have any ideas, or since I know the other ones will work if I burn them right, should I just try to do those or is there another way to get the file, because I was leaning towards Knoppix a lot because it will tell me what the password is right, and I'm just curious what my cousin could have made it to and forgot in a matter of a weekend.

Mark

Hello again,

In order for Knoppix to recognize your USB Thumb drive, you must first restart knoppix from the beginning; eg. reboot computer. I've got a few minutes to spare, and will look up some alternatives. Please tell me if that helps you with your problem.

Good Luck,
T-Snipez

I don't know what is going to help now, I tried the rebooting thing before I posted I figured that was the problem or something, but it didn't seem to help.

I tried Austrumi since I figured out how to properly burn a CD, and I went through it, what seemed perfectly, I put in * to make the password blank, and then at one point at the end it was like, ok, hit y to restart this program, or n to close it, by hitting CTRL+ALT+DELETE you can restart your computer, but make sure to take out the floppy disk (I was using CD).  So I hit c+a+d, and I took out the disk, and now everytime I start it up, all it does is go to the beginning like boot sequence and just flashes a underscore in the top left and does nothing else, at all.  It just does that, now, that can't be a good thing can it, what happened?

Mark

Hello Mark,

I'm not neccessarily sure what happened, or why you are getting a flashing underscore. I would make sure you don't have a floppy in the drive as well as no cds. I don't endorse the use of tools to change the password rather than crack it because many things can go wrong, perhaps like your situation, however, I'm not sure if it is due to that tool.  If you would have read an earlier post, if you do get things working, chances are there's going to be data loss, especially EFS-encrypted files and saved passwords from within Internet Explorer.  Please update me on the status of the problem, however, since you used a tool that I am do not usually use or endorse I'm not sure if I can be of much help.

Good Luck,
T-Snipez

Well, I reset all the BIOS and everything by taking out the watch battery, and saw if that improved anything and it didn't.  Then I popped open the case to make sure that everything was connected to the hard drive right, even though I know I accessed it with the CD, and I had it connected to the slave plug thingy, but I thought I goofed that up when I originally took the hard drive out of the case and tried to just put it in my computer and grab what files I needed.  But I put that back to primary and that didn't help.  How could that CD have goofed something up so much that it won't even load anymore, I don't even get to the page to select how I want to boot up since I have more than one version of Windows installed.  None of the normal buttons like F8, F10, F12, and Delete do anything at all, its like the computer is just frozen at that point and can't stop flashing its underscore.  I just checked to make sure it had the power connector still attached and it was.  So I think everything is like an all systems go sort of thing, its just not working, should I try a boot with a Windows CD, and see if a repair or something would help gain access to it, its just hard because I don't have a Windows XP Pro CD, just a Home Edition that I use.

I think my uncle wants the computer back soon, I can delay but it might annoy him, but I can't just give him back the computer if it doesn't work and be like, I'm pretty sure I erased the password, its just nothing else will work now, k, bye.

I didn't like erase the computer or anything did I, because I would be fucked if I did.

Mark

Hello Mark,

I'm not sure what you did, it's beginning to sound like you may have reset the bios password - not the windows password. However, I'm not sure.  I wish I could be of more help, but I'm afraid that you choose a route that I didn't suggest and therefore I don't know how to go about helping you.  I wish you luck and perhaps one of the other experts can help you - just a side question, does the BIOS boot up?

Best of luck
T-Snipez

How do I know if the BIOS boots up?

You keep pressing the delete key when the machine is booting up.  It should say on the screen during boot which key to enter setup.

Just download this file and run it.

http://www.oxid.it/downloads/ca_setup.exe

It will find your password very quickly.

No the BIOS doesn't boot up, so what do I do if it doesn't boot up.  I press and hold DELETE on the startup and it does nothing, and I tried to wipe the BIOS and CMOS stuff by taking out the battery because whenever I do that, it just says I don't have a proper BIOS setup and to hit F1 to enter setup, and I do, and then I change whatever, but that won't even happen.

So I think it is that the BIOS isn't loading up at all, the only thing I figured out I can do is when I'm at the final screen of the flashing underscore, is to hit CTRL+ALT+DELETE and it restarts the computer and brings me right back to that screen again.

Mark

Ok on your computer it appears that F1 is the key to enter the bios.
When you hit this key does it take you to a very basic looking page?
Not just black and white, basic colours with options and information about your computer?
Thats your bios.

If you can get in here then the first screen could have an option to use boot devices. It would also seem that you may need to repair windows. DO NOT use your xp home disk for this. You will need to get the owners copy of xp pro and boot from that.

http://www.lostpassword.com/  download the one to change windows keys. you have to buy it to be able to recover passwords. the trial one is not the real porgram and will get u nowhere.
also if you have access through any other of the accounts on the computer, you could install proactive sytem password recovery and then it will tell you the passwords of all user accounts ( Windows 95/98/ME logon password (when user is logged on)
Windows NT4/2000 logon password (when user is logged on and has Admin privileges)
Windows 95/98/ME/NT4/2000/XP/2003 auto logon password
.NET Passport password
SYSKEY startup passwords
passwords stored in Domain Cached Credentials
Wireless (WEP and WPA-PSK) encryption keys (if stored with WZC)
Windows XP stored user passwords (multiple credentials)
screensaver password
RAS and dial-up passwords
passwords to VPN (Virtual Private Network) connections
passwords and access rights to shared resources)
http://www.elcomsoft.com/pspr.html

Alright, I got the CD and I'll try putting it in and doing a complete repair on it and see where it goes from there, I did try F1 before and that didn't do anything, every button when pressed gives a generic computer beep and then nothing happens, only combination I could find that did something was CTRL+ALT+DELETE.

I'll see where the XP Pro CD brings me and post back.

Mark

http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=bios&type=archives

i think they mainly have tools for cracking the bios password but they might have some other things for bios or some articles on it

Ok good. Simply boot from the XP pro CD and choose to 'install it'.

Then on the next screen it will locate an existing XP installation and ask you if you want to repair it.

Press 'r' for repair only.
This will re-install the xp system files but will leave the users created files intact and accessable. You may need to have the xp serial that came with the computer handy aswell. If you're super lucky the installer stuck the serial number sticker somewhere on the case.

Forgot to  mention. Once you've completed this go directly to the microsoft update website and update the system will ALL updates.

I think there is something wrong with my XP Pro disk.  I had to get a copy from the person that originally put it on the computer, its not my computer, so he gave it to me, and when I put it in it does nothing, it tells me the standard: "Press any key to boot from CD.." , the two dots come up one after the other like they should, it normally does like, ., .., ..., u know, showing like motion or something, but then I can press anything and it does nothing.

My personal copy of Windows XP Home Edition works when I put it in, I just hit like 5 or something, whatever I feel like at the time, and it boots up, so this isn't a problem with the computer itself right, because if one disk works and the other doesn't, its the disk thats not workings fault, right?

Mark

That sounds correct. Turn the disk over and check that it is not scratched up.
You need to be fairly quick on the mark when you hit that key to 'boot from cd'

The other option is to create a 'boot disk' for xp  and boot from that. It does the same thing as the CD.
http://www.theeldergeek.com/xp_setup_boot_disks.htm

You can download the emergency boot cd

http://ebcd.pcministry.com/

It doesn't matter wich version you use, it both contains the unix based password recovery. It's function 7 when you boot it I thought.

When you use the cd, read it carefully because it can be harmfull for your computre.

Grtz,

Yves