Linux Format forums

[Bruno]

Hi All,

I've got a Win XP partition that I seldom use and I have forgotten the passwords (user and administrator) for it. Reinstalling is an option, as it contains no precious data/programmes but I'd prefer a more intelligent solution.

Does anyone know how can I get back in? The passwords are likely to be 12 characters long and the host machine is about 7 years old, so brute force is probably a no-go.

From searching, I have found that Windows XP keeps its user/password data in C:\WINDOWS\system32\config\SAM but the passwords are of course encrypted. Can I prepare a new SAM file with a known password and put it in place with System Rescue CD?

Another option is to read the Password Hint, but I don't get the option to see the hint on the login screen and can't find out how to get to it. Apparently the hint is stored in the registry as the default value in the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Hints\<Username> but I can't read the registry easily from System Rescue CD. Does anyone know in which file this is located?

Thanks in advance,
Bruno

[Bruno]

Hi All,

I've found the solution; needless to say, not on MS Knowledge Base. A chap called Petter Nordahl-Hagen has produced a utility called "Offline NT Password & Registry Editor".

It's a live Linux CD or USB stick, and it will modify the SAM file to change or remove the password of a user or administrator, including the administrator. There was a warning about changing the password not working on XP and indeed I found that this didn't work, so I removed the password on the administrator account, booted windows and got back in. It was then just a matter of changing the passwords for all accounts and it was job done, reinstallation not necessary.

The whole utility weighs in at 4.1 MB. I'm very impressed. One for every sys-admin who has to take a trip to the dark side now and again.

[ajgreeny]

[Bruno]

Yep, Linux to the rescue again