Take the 2-minute tour ×

A friend of mine generated a new Administrator password for our Windows server with KeePass. At the same time, my... er... his PC manufacturer's auto-update was installing new graphics card drivers. I'm sure you can see where this is going — the password was successfully changed at the server and then the graphics card driver update failed, resulting in a crash before the generated password was saved in the KeePass database. Schoolboy error, I know.

My host provides a recovery mode for Windows, but for some reason it won't boot (of all the luck) and they're taking forever to look into it. I can boot into a Linux (debian) recovery system and mount the Windows drive, so I'm wondering if there's anything I can do from there? My Linux knowledge is pretty poor, I know there's chntpw but I'm not sure how to install it (apt-get is available, but I don't know which source to add or how to add it).

I've seen similar questions but they all involve having physical access to the machine. The responses to those questions are usually:

  • Boot into the recovery system and replace one of the accessibility executables with cmd.exe, then use the key combination at the logon screen.
    I don't think I can do this because I can't access the logon screen via Remote Desktop. I'm always asked for credentials before the connection is complete.

  • Use chntpw from Linux to change the password.
    As mentioned above, my experience with Linux command line is poor. Aside from this, I've heard that it changes machine passwords only and I'm not sure if the Administrator is an Active Directory account.

As a last resort I can re-image the machine but I spent the last week setting everything up and I'm hoping I can avoid all that time spent being for naught. I can use PuTTY for terminal and WinSCP to play around with the files if that helps.

Does anyone have any suggestions?

Update - I can now access the Windows Rescue System via TightVNC. However, all the commands apply to this separate instance of Windows - how can I change/recover my password on the main Windows installation?

share|improve this question
Is the Windows machine on Active directory or no? If it's on AD, it won't have a local administrator account. –  Bart Silverstrim Mar 1 '11 at 0:06
@Bart: I'm embarrassed to say I'm not sure. It's just a dedicated server with 1and1, I'm not savvy enough to know the difference. The Administrator account is in the SAM file, if that helps at all. –  Andy E Mar 1 '11 at 0:10
I'm protecting this question since [password-recovery] attracts the spam-bots. Do continue... –  sysadmin1138 Mar 1 '11 at 0:33
@Bart: A domain member computer will have a local administrator account. Domain controllers don't have local administrator accounts. –  joeqwerty Mar 1 '11 at 0:43
@Joeqwerty: you're right, I should have been more clear. I meant DC when I said that earlier (can you see my cheeks turn red for not being more clear? Sorry Andy...) –  Bart Silverstrim Mar 1 '11 at 2:29

3 Answers 3

I'm not familiar with what out of band management a server from 1&1 might have but if there is anyway you can attach an ISO and boot from it the Microsoft DaRT (Microsoft Diagnostics and Recovery Toolset) ISO can reset the passwords.


share|improve this answer
I'm guessing DaRT is part of MDOP which doesn't have a direct download link...? If it has this many acronyms and steps to figure out how to get the @#$% thing it makes me wonder if I'd want to mess with it :-/ –  Bart Silverstrim Mar 1 '11 at 2:32
You can download it for free if you have MSDN or Technet access. Ultimately what is contains is the old WinInternals LockSmith utility (amongst others) and this tool works very well to reset the admin password. –  Ausmith1 Mar 1 '11 at 2:36
I can access the serial console, but all it allows me to do is list/kill processes, play with the IPv4 stuff and restart the server. I can boot into the rescue system, which looks like some sort of PE loaded into RAM across the network. It has Firefox and File/FTP Managers, but I'm not sure how I could reset the password. –  Andy E Mar 1 '11 at 10:51
up vote 1 down vote accepted

It seemed like, in the end, the best approach would be to initialise the server. I was wasting a lot of time trying to get access back and I'm not convinced at this point that it was possible to do remotely. I spent a good 16 hours or so trying to crack or disable the password using various outlets like the serial console or the Windows/Linux rescue systems and had no luck whatsoever.

Re-imaging my server took 1 hour and then I spent the rest of the day restoring backups and installing software. If I'd done that to start with I'd be asleep right now, so lesson learned.

share|improve this answer
Have to go with this - sometimes the pragmatic approach is to just take an hour to rebuild something rather than 2 hours to "fix" it. –  RobM Mar 2 '11 at 11:02
...and I still didn't get the damn graphics card driver installed properly. Stupid Vaio Update. –  Andy E Mar 2 '11 at 11:54

This is just a wild shot in the dark.

If you have out-of-band mgmt such as DRAC or iLO, from linux, you could make a copy of winlogon.exe and then copy cmd.exe over winlogon.exe. If the server is rebooted, maybe you will have a command prompt running as the SYSTEM account. From this, admin you could change the password or create a new admin account. Afterwards, you could replace winlogon.exe with the correct version (from within linux).

share|improve this answer
If I did that, I don't think I'd be able to connect via RDP, would I? Doesn't it require winlogon.exe? –  Andy E Mar 1 '11 at 0:46
This would not work with RDP. You would need OOB management. –  jftuga Mar 1 '11 at 0:52
I have serial console access, but it requires the admin password to log on, so I guess that doesn't help? –  Andy E Mar 1 '11 at 0:56

protected by sysadmin1138 Mar 1 '11 at 0:31


Would you like to answer one of these unanswered questions instead?
