Link to home
Start Free TrialLog in
Avatar of Webcc
WebccFlag for United States of America

asked on

Password reset on Windows 7 with Bitlocker turned on

We have a Windows 7 laptop that the previous IT consultant setup and did not leave the correct Admin password.  The laptop has bitlocker enabled so, I cannot change the Admin password using conventional methods.  Outside of re-imaging is there anyway to gain access?

Thx
Avatar of Webcc
Webcc
Flag of United States of America image

ASKER

No, just a password reset utility which cannot gain access to the encrypted system partition.
No I don't believe it does.  Any chance you could get the password from the consultant?
Avatar of Joe Winograd
> Reference to software not allowed in Experts-Exchange.
> Reference to software not allowed in E-E deleted.

John,
I'm really perplexed by these comments. Experts give references to software frequently. You must mean something different from what I'm thinking, as referring to software solutions on EE can't possibly be not allowed. Please explain. Thanks, Joe
Software suggested rhymes with Siren and is not allowed here. Never has been.
I have been reading through bitlocker documentation and the suggestion to try the consultant again is the best so far.

You might be best to get a new hard drive and start again with Windows.
Oh, so you're talking about reference to a particular piece of software. What about it makes it not permissible at EE?
It is software that contains pirated software. That is why.
Got it! Thanks for explaining.
Avatar of Webcc

ASKER

Thanks for the clarification on that!  Looking only for white hat solutions!!  Obviously, we tried contacting the previous consultant for weeks before posting.....

Thx
Question is: Bitlocker with or without TPM? If TPM, with or without PIN?
Without a TPM, the solution is very simple. Take any setup dvd, boot it, press shift F10, on the command prompt, mount the bitlocked c: drive using manage-bde, exchange utilman.exe against a copy of cmd.exe... I hope you know the rest of the story (or I will explain further). But if you have a TPM in use and you don't have the recovery password, only the TPM PIN, you have no chance.

So it depends. How is your Bitlocker setup?
Avatar of Webcc

ASKER

How can I determine if it is TPM or not?
Well, how do you start the machine? Do you just turn it on, hands free, until the windows logon prompt appears?
->That's a TPM being used transparently
...or do you need to enter a PIN?
->That's a TPM+PIN combination
...or do you insert a USB stick to boot it?
Avatar of Webcc

ASKER

Turn on, hands free.
That's bad, you have a TPM "as adversary". It works like this: the TPM provides the cryptographic key automatically...but only if certain conditions are met (BIOS is not being tampered with, the mainboard is still the same, no boot media like DVDs are being used to start the machine and so on). If those are not met, the recovery key is required to mount the drive. Yes, you can only mount (and write to) it, when you have that key - I bet you don't. But there might be a chance that it got saved to a file, printed out or even saved to active directory. So please find that out. If you have it, all is good. if you don't, it will become specialists' work.
Avatar of Webcc

ASKER

Time to re-image the drive I guess.
SOLUTION
Avatar of John
John
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
@Webcc  - Good luck with a new installation. Thanks.