Solved

Safe Boot Never Shows Desktop - Black Screen

Posted on 2006-11-03
24
418 Views
Last Modified: 2008-03-17
Hello All...

I confiscated my son's workstation due to his desire to continue communicating with what I prefer to call "an undesireable element". He has refused to give me his password to review the system and I can not get logged in under the administrator account. The log-in screen shows only his account, so I boot the system into safe mode which then shows his and the admin account. After I log in, however, the screen displayes "safe boot" in the four corners and the OS information at the top, but no icons or task bar appear.

I downloaded a shell applicatoin recommended elsewhere on this site for changing a user password. It seemed to run correctly and update, but I still get asked if I have forgotten my password when I try to log into his account with the new one I entered. I would appreciate any thoughts on this issue.

Rick
0
Comment
Question by:commonsensetech
  • 5
  • 4
  • 3
  • +6
24 Comments
 
LVL 38

Accepted Solution

by:
younghv earned 500 total points
ID: 17868094
Hi Rick,
Depending on just how mad you are (I'm a Dad - and a Granddad), I would just reload the whole dad-gummed computer from scratch.
Any lost data (for your son) should be filed under the 'lessons learned' category.

If you don't want to go that route, check out these sites:

Recover Lost Administrator Password
http://www.alaynah.net/shehar/forget_password.htm
http://www.petri.co.il/forgot_administrator_password.htm
http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=305


Vic
0
 
LVL 29

Expert Comment

by:ScottCha
ID: 17869124
I know this is off your topic but if I were in the same situation I'd do what younghv suggested and take it one step further...

Ban him from the internet.  I'd give him a word processor, printer, and tell him to have a nice day.

If he needs to use the internet for school he can do it from a public place such as the library.  Or get him encarta or some other encyclopedia program.

"Undesireable elements" on the internet are nothing to fool around with.

Keep a sharp eye out for ANY unusual behavior or happenings around the house.

Privacy is for those who earn it.
0
 
LVL 76

Expert Comment

by:arnold
ID: 17870032
Once you are logged in, you have administrative rights such that you can change his user password.  You will then be able to login as him.  If you leave the administrator account without a password, your son can do the same i.e. boot the system into safe mode and change the password back. And then set the administrator password.

You should look at enabling content restrictions in the browser or look on the net for plugins into IE/local policy that will provide you a better control for access.  Optimal solution is to get a router/firewall that you can then manage and control which sites can and which sites can not be accessed.
0
 
LVL 24

Expert Comment

by:SunBow
ID: 17870228
1) As it stands, first try to set up yourself two additional accounts, one for admin authority, one not. Check whether that does any good.

2) Boot to last known good configuration, you  can pull plug from modem to reduce that issue. This is more likely to work than #1

3) Use bootable diskette to login, and also try to use install CD to login as administrator

4) Ask your son, do not hack it. You may need a week for cooling off period. By that time, it is time to get family who see each other back together again, without bothering having to think us strangers on the internet being of any greater value than the family. Ensure that you know that within yourself, no matter what you find on the HD will not affect your expressions of affection for your family. Criticism must sound constructive, like reasoning, not like blame.

5) Move HD to another PC so you needn't boot it, make it drive 2 and look for some of the different things that might have been added

6) Some additions may have been made to registry or list of startup programs. Remove startup programs, move them to backup directory, check SysTray and TaskManager and \Run's

try to not change passwords if you do not have to

Ditto ScottChaj ust emphasize you actually care for him, that you are not calling him 'bad' or blaming him personally, just trying to enforce house rules as best you can with your own limited knowledge - perhaps even innuendo that he may want to help you someday, or you may want or need his help some day
0
 
LVL 6

Expert Comment

by:neomage23
ID: 17870977
I totally...totally...agree with the first comment from YoungHV/Vic...

If you really want to punish him...download a DBAN DOD WIPE DISK and clear the system beyond any possible recovery.
Alternatively...

You can use this utility...
http://home.eunet.no/pnordahl/ntpasswd/ (the actual file is here) http://home.eunet.no/pnordahl/ntpasswd/cd060213.zip

to "blank out" the admin password...just read up the the utility first at the website.

The caution to you is this....

Your son seems to be hiding something from you. Depending on your approach to parenting you may want to find out what that something is. But if your son is clever, then he may have encrypted the files...so if you change his password then you may not be able to access those files. What you will probably want to do is pull the hard disk from the computer and make a copy of it...with a disk imaging utility. Then clear his old disk...then reinstall windows xp...then install a hidden keylogger to find out exactly what is going on before you flip out. Find a keylogger that will email you all of his keystrokes once per day. He will probably make himself the same password...

Then, you can take his computer one day...put in the old disk and boot from it, then use the password you captured password to log in as him and view his files.

Alternatively, you could seek out the services of the police department or a private computer forensic investigator. A pro investigator, (like myself) can bypass all of the security protections and look at the raw data of the drive to piece together what is going on.

I think you're on a slippery slope though...if the undesireable help is sexual or illegal in nature - and you think your son might be "addicted" then you might want to consider finding a professional to assist you --- "get inside your son's head" --- I'm not a parent myself, but I was a defiant child and I can tell you that when people came down hard on me it would drive me FURTHER into finding ways to cover up my activities.

-neo
0
 
LVL 7

Expert Comment

by:jalilthe1
ID: 17872080
ANSWER:
The Windows 2000 Administrator and User passwords are very important tools to access your system. If you forget these passwords you will not be able to log into your system and access files, programs, etc. This is particularly a problem if your system is formatted with the NTFS file system.

There is no native Windows-based method for changing the Administrator password if you've forgotten it. The best solution available is to boot your computer with a special Linux-based floppy disk, which will allow you to change your Administrator password.

This disk may be downloaded from the Web at

    http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html.

If the utility asks for a registry path, it is usually winnt/system32/config. Depending on where Windows is installed, you can also try windows/system32/config, windows/system, or simply windows.
--------------------------------------------------------------------------------------
Offline NT Password & Registry Editor, Bootdisk / CD
http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html
--------------------------------------------------------------------------------------

Good Luck,
Jalilthe1
0
 
LVL 70

Expert Comment

by:Merete
ID: 17872728
BTW Rick it is normal to have no desktop in safemode, if youhave not accssed safemode before then all you may see liek a brand new windows and you'll have to setup the desktop per say.
Go to the start menue and r/click any folders you wish to show on the desktop.
Is this xp home or pro?
If you all have administrative accounts you can access some of his files from C drive documents and settings  here you can see the all the accounts.
the other way to access his account
slave the hdd  move the pin on the rear to slave first.
on another computer running xp and is an administrative account..  use the master cdrom ide ribbon and power plug in to this hdd.
unpower of course but is very easy to do, just sit the hdd ontop of the tower.
power in again, reboot, this drive will now be d drive, if you cant open the folders take ownership of them.

How to take ownership of a file or folder in Windows XP
http://support.microsoft.com/kb/308421
0
 
LVL 2

Expert Comment

by:sulfur_based
ID: 17872798
Getting back the the OP's question tho...

Obviously, the Administrator account has no password on it.  It's just that when logging into it in safe mode he doesn't get the desktop.  

Rick,  if the os is XP Pro,  then pressing CTRL-ALT-DEL twice while at the Welcome screen in normal mode will give you the old style login box.   You will then be able to log in as Administrator.  Leave the password blank.    This won't work in XP Home tho.

Otherwise, you will have to use one of the password changers mentioned above... jalilthe1 has the right idea.   Don't be worried about losing access to encrypted files in your son's account, because XP Home doesn't do encryption.

Cheers

P.S.  It's definately not normal to have no taskbar in safemode.  You don't need to "setup the desktop per say" except that since the admin account has never been used before it won't have any personalised icons on it.  It will still have at least the recycle bin and any "All Users" icons.
0
 
LVL 38

Expert Comment

by:younghv
ID: 17873070
sulfur_based,
Since you're new around here, maybe you don't yet realize the importance of carefully reading through the initial post and all subsequent suggestions.
Referring to posts made hours after several others with identical information as the 'right idea' is "definately (sic) not normal".
0
 
LVL 70

Expert Comment

by:Merete
ID: 17874826
Morning all,
Rick Any progress yet

sometimes the taskbar is hidden even in safemode could you confirm this, move your mouse over the lower area of the screen and see if the taskbar appears.
If this was your sons computer he may have this option enabled.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 38

Expert Comment

by:younghv
ID: 17875052
Morning Merete (2000 Hours this side of the world/equator).
How's life in paradise?
0
 
LVL 70

Expert Comment

by:Merete
ID: 17875230
I am truely living in the lucky side of this country too, At the top in far North Queensland  rain and cold green and fresh, where as many parts of Australia are in drought.
Where are you younghv
0
 
LVL 38

Expert Comment

by:younghv
ID: 17875987
Merete - Tennessee, US. The real home of the 101st Airborne Division, Country Music, and the Great Smoky Mountains. Temperate weather. One of my life goals is to visit Australia.

Rick - you still beating on this thing or did you take the weekend off?

Vic
0
 
LVL 6

Expert Comment

by:neomage23
ID: 17878671
rick, another tip for you is this...

if you get into safe mode again and you see a blank screen, just hit ctrl+alt+del to bring up the task manager...

when you have it up, click the applications tab, and click... NEW TASK

in the run box that comes up type "EXPLORER"

the task bar and start menu should come up.

-neo
0
 
LVL 24

Expert Comment

by:SunBow
ID: 17884395
actually, TaskManager is a task. Some difficult peoples like to move taskbar to one of the other three walls, and some video drivers utils will also move it, enhance it, which may mean having a need to replicate their installed resolution. Try 1024 by 768 pixels, for example. Try more?

Note that such wares are not always populated to other accounts, such as for Administrator, which may merely be suffering some incompleted install, from their POV.
0
 

Author Comment

by:commonsensetech
ID: 17955640
Amazing to me how few people really *read* my post.

Sorry for the delay in getting back. Neomage and SunBow - I tried to launch the taskbar and see it start, but it immediately shuts down. I pulled the drive and attached it to my work system as a slave and ran virus and spyware scans (Norton, McAfee, SpySweeper & Ewido) but aside from a few innocuous tracking cookies found nothing. I have not attempted a resolution change, but will do so this evening.

Rick
0
 
LVL 29

Expert Comment

by:ScottCha
ID: 17955706
I'm not surprised you didn't find much with virus scanners/sweepers.  I was under the assumption you wanted to actually sign onto his machine as him or with an account with full permissions.

There were a number of utilities mentioned to reset passwords on the accounts.

One that I have used and had much (read 100%) success with is:

http://www.petri.co.il/forgot_administrator_password.htm#4

You create a boot CD and boot your son's computer with it, follow the instrucitons and reset the password to "nothing", reboot and then have full access to his machine.

It's a very fast and painless way to reset passwords on NTFS systems.
0
 
LVL 38

Expert Comment

by:younghv
ID: 17955792
Rick,
It sounds as though you're getting as frustrated with us as you are with your son:
"Amazing to me how few people really *read* my post.".

I stand by the post I made about 10 minutes after you posted the question.
1. Reload the box - that way you set the Administrator password and control the accounts.
2. Use one of the tools at the links I provided to change/delete the existing password.

Be aware that IF your son has 'encrypted' data, it will probably be locked out forever when you change his password.

Post back when you can.

Vic
0
 

Author Comment

by:commonsensetech
ID: 17955796
From my opening post:

"I downloaded a shell applicatoin recommended elsewhere on this site for changing a user password. It seemed to run correctly and update, but I still get asked if I have forgotten my password when I try to log into his account with the new one I entered."
0
 
LVL 29

Expert Comment

by:ScottCha
ID: 17956362
Here's another one I've had success with...

http://home.eunet.no/pnordahl/ntpasswd/

If you're not able to reset/crack the password, I concur with younghv.

Reload the box, you set the admin password and set up a user account for your son with limited permissions.

I'd also install an invisible keylogger to keep an eye on things:

www.guardiansoftware.com

www.spectorsoft.com

0
 
LVL 70

Expert Comment

by:Merete
ID: 17960425
commonsensetech  I think your best options here is to slave the hdd.
Is this a separate computer or separate partition on the same computer separate accounts on one?
If youhave another computer there
Just hook on behind the master drive or to the cdom behind the master hdd is slave and the cdrom is also a slave. You dont need the cdrom to boot just replace the ide ribbon to cdrom whne you are done.
Move the jumper to slave and unpower by removing the power plug before adding the hdd.
Then take ownership of the files.
How to take ownership of a file or folder in Windows XP
http://support.microsoft.com/kb/308421

Index.dat are files hidden on your computer that contain all of the Web sites that you have ever visited. Every URL, and every Web page is listed there. There are multiple Index.dat files in different directories that keep a copy of whatever there is in that folder and they continue keeping those records even after you have deleted the contents of those folders.

http://www.eusing.com/Window_Washer/Index_dat.htm
 Index Dat Spy exposes information "hidden" in index.dat files on your computer. This information includes URLs of web sites that you've visited, even though you may have cleared your history. If there are multiple users that log onto your machine, it also exposes which user visited each site. This can be useful for checking on what Web sites your kids have been visiting and when.

http://www.stevengould.org/software/indexdatspy/
screenshot here
http://www.topshareware.com/Index.dat-Viewer-download-1761.htm
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

In this article we will discuss all things related to StageFright bug, the most vulnerable bug of android devices.
#Citrix #POC #XenDesktop #vCenter #VMware #ESX
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now