Security Basics mailing list archives
Re: Windows 2000 Administrator lockout
From: jeffry () daxa net
Date: Thu, 19 Aug 2004 09:12:33 +0700
On Tue, Aug 17, 2004 at 07:25:49PM -0400, Mark Medici wrote:
Petter Nordahl-Hagen has a linux boot disk with a utility to change passwords in NT4, 2000 and XP. See http://home.eunet.no/~pnordahl/ntpasswd/. I have used it successfully on Win2K Pro and WinXP Pro. It will also probably work fine on Win2K Server, as long as a recognized disk controller is present. However, most servers use some method of RAID protection for their hard disks. Since Linux is not my strong suit, and I figure it would take me longer to find and figure-out an appropriate disk driver, I use a different (and, I believe, safer) approach to resetting the password on servers: Do a basic install of Windows to a new path on the system (i.e., C:\WINNT.FIX). Make sure to specify the correct disk driver. Don't bother installing networking or configuring any options. Boot the new install of Windows and logon as Administrator, using the password you supplied during setup. Install the appropriate service pack to match the normal install. Reboot this new install again and logon as administrator again. In the new Windows install path's SYSTEM32 directory (i.e., C:\WINNT.FIX\System32) copy LOGON.SCR to LOGON.SCR.ORIG. In the same directory, copy CMD.EXE to LOGON.SCR. Logout and boot the original Windows install. Wait for the screensaver timeout to expire (make sure you don't touch the keyboard or move the mouse until then). A CMD.EXE window should appear on-screen, in the security context of SYSTEM. In the CMD.EXE window, issue the command to launch the appropriate utility to manage users on your platform: Windows 2000 Domain: DSA.MSC Windows 2000 Workgroup: LUSRMGR.MSC Windows NT 4 Domain: USRMGR.EXE Windows NT 4 Workgroup: MUSRMGR.EXE Locate the Administrator account and change the password. While you're there, create a second account with Admin membership as a backup. Exit the CMD.EXE window and logon normally using the Administrator account and new password. Restart the original Windows install and verify. Clean-up (delete LOGON.SCR, rename LOGON.SCR.ORIG to LOGON.SCR, fix C:\BOOT.INI so the original Windows install is the default boot, removing all reference to the new install, then delete the new install directory).
Hello, IMHO it is best to use the password cracker from http://home.eunet.no/~pnordahl/ntpasswd/ since it is a lot more easier, if you do use scisi HD you should download the scisi driver provided in that web too i have try the software to crack the password in one of my w2k server using scisi HD and it works like magic :) anyway it's up to you which path will you choose :) Regards -- Jeffry
-----Original Message----- From: Robert Ritchey [mailto:rritchey () eods com] Sent: Friday, August 13, 2004 2:55 PM To: security-basics () securityfocus com Subject: Windows 2000 Administrator lockout Hello All, The network that I have is rather small. 1 server, and 4workstations.I inherited the systems. There has been no administrator workingtherefor a little over a year. What administrator that was there, was very much non-technical. When the network was built whoever built the server installedeverythingthey possibly could. This system now how few main functions: 1. File server 2. Internet Gateway 3. Symantec Virus manager Nobody knows any of the passwords for anything on the system. Any of the passwords that are in use are not allowed administrator access. I do mean for anything! I can't even get Symantec to update virus signatures, as I do not have a password to do the update with. The signature is like 2003 date. It is just very frustrating! I am looking for options, before I have to go and reformat andrebuild.This would in some ways make life simpler, there are wrinkles in that all of there operational data and other services are on the server.Weare currently moving foreword with a plan to rebuild. This willhappen;I would rather pick the time to do it. Rather than have it forced on me. Does anyone know of any other way to take control of this machine and network. Thanks for your time and any ideas will be appreciated. Robert Ritchey------------------------------------------------------------------------ --- Ethical Hacking at the InfoSec Institute. Mention this ad and get $545offany course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expertinstructors.Attend a course taught by an expert instructor with years ofin-the-fieldpen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of yourorganization.Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html------------------------------------------------------------------------ ------------------------------------------------------------------------------- Computer Forensics Training at the InfoSec Institute. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse so that it never happens again. http://www.securityfocus.com/sponsor/InfoSecInstitute_security-basics_040817 ----------------------------------------------------------------------------
-- Jeffry --------------------------------------------------------------------------- Computer Forensics Training at the InfoSec Institute. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse so that it never happens again. http://www.securityfocus.com/sponsor/InfoSecInstitute_security-basics_040817 ----------------------------------------------------------------------------
Current thread:
- Re: Windows 2000 Administrator lockout, (continued)
- Re: Windows 2000 Administrator lockout Bruno Guedes Souto (Aug 17)
- Re: Windows 2000 Administrator lockout fiber (Aug 23)
- Re: Windows 2000 Administrator lockout some guy (Aug 17)
- Re: Windows 2000 Administrator lockout Ansgar -59cobalt- Wiechers (Aug 17)
- Re: Windows 2000 Administrator lockout Mark Johnson-Barbier (Aug 17)
- RE: Windows 2000 Administrator lockout Rob Morgan (Aug 19)
- Re: Windows 2000 Administrator lockout Alexandre Verriere (Aug 23)
- RE: Windows 2000 Administrator lockout adisegna (Aug 17)
- RE: Windows 2000 Administrator lockout Dinis Cruz (Aug 20)
- RE: Windows 2000 Administrator lockout Mark Medici (Aug 18)
- Re: Windows 2000 Administrator lockout jeffry (Aug 23)
- RE: Windows 2000 Administrator lockout Tarun Bansal (Aug 23)
- Re: Windows 2000 Administrator lockout Ansgar -59cobalt- Wiechers (Aug 24)
- RE: Windows 2000 Administrator lockout Ferino Mardo (Aug 23)
- Re: Windows 2000 Administrator lockout Bruno Guedes Souto (Aug 17)