blog.saalmink.nl

Today i needed access to a domain of servers, but one of our competitors would not provide us with the Administrator password, so i needed other ways to get in.

Petri.co.il has a nice page on that subject that consists of 2 steps:

1. change the local administrator password (so you can boot into Active Directory restore mode)
2. install a service to change the domain password

Somehow step 1 lead me to corrupt SAM/Software/system files so after restoring the original files i figured a way to skip that.

All you need is a Windows live cd or usb stick and the zipfile below. BartPE will do. Or use a commercial product like Active@ Boot Disk, which is really nice because of the fact that it’s based on a Vista kernel which supports the loading of drivers without rebooting. So you’re able to load drivers for raidcontrollers or other devices and your drives will appear directly.
Download this file and put it on a usb stick.

Now here we go:

1. Boot your Windows live environment.

2. Extract the content of the zip-file to c:\.
   You’ll have 2 directories.
   C:\RegEditPE
   C:\srvany

3. VERY IMPORTANT: make a copy of your c:\windows\system32\config now. Just copy the entire directory to some location.

4. Start C:\RegEditPE\RegEditPE.exe and after it’s done browse to HKEY_LOCAL_MACHINE.
   You’ll see new hives for windows installations that have been found, e.g. “SYSTEM_ON_G”.

5. Edit C:\srvany\_service.reg and replace (ctrl+h) “SYSTEM_ON_E” with the one on your system.

6. Check the line that says:

   "AppParameters"="/k net user Administrator 123456abc /domain"
   

   As you can see the password will be changed to “123456abc” but keep in mind that your domain can have complexity policies! Change to something more complex if needed!

7. Save the file.

8. Now doubleclick the file to merge it into the registry and close RegEditPE.

9. I’ve provided cmd.exe from Windows 2003 SP2 in the zipfile, but you might want to do:

   copy x:\windows\system32\cmd.exe x:\srvany\
   

   (where x is your drive with your Windows installation.

10. Reboot and wait a little. Now you can log in with your new password.

Tested on Windows 2003 SP2