1

This guide will help you reset any kind of username credentials (user, domain administrator) on any kind of Windows OS (Client, Server) WITHOUT DATA LOSS.

I’m used to using Windows in German and therefore may have translated a few words incorrectly.

I’m not sure how many know this trick. As I first tried it, I though it was a prank.
Please read the guide entirely, before you dismiss it as nonsense.

Step 1: Boot Windows using an installation or recovery media - reach a CMD prompt

If you use the built-in recovery/repair, you will need to provide credentials. If you had credentials, you wouldn’t be reading this guide.

You need to reach a CMD prompt, as we will use it to rename two files.

In all fairness, you can use any method you like, as long as you have the option to rename two files under %windir%\system32 (like connecting the drive using an SATA adapter and renaming the files there).

Step 2: Rename the files

Navigate to system32 (normally C:\Windows\system32).
We need to rename utilman.exe to utilman_old.exe and cmd.exe in utilman.exe (IN THIS ORDER!).

Step 3: Restart and boot into Windows

If you need help with this step, you may not be the right person to use this guide.

Step 4: Click on the Ease of Access button

cee3519ba7870c136f10134c86feacd25dc5c796e40c3c924b1220df42f9d724_img_59cb0bfcbed80.png

Every Windows Version should have a symbol on the login screen, like the one in the attached image.

Step 5: Enjoy full administrative access

You just started a CMD prompt with SYSTEM privileges.
You can use “net user ” to reset your password or just wreak havoc on the system. How dare it has a password you forgot!

Step 6: Restore the files to their original name

Boot again in CMD outside of Windows and rename the files again (utilman.exe to cmd.exe and utilman_old.exe to utilman.exe).

Step 7: Profit?

With great power comes great responsibility.
Please do not go about and reset your colleagues’ passwords just for the sake of it (as I did).

8 Spice ups
2

Why would you need to reset domain accounts this way if you administer an AD environment? As for local accounts, if it’s on a domain, you can log in in with a domain admin or any other user/group that you’ve added to local admins. If it’s just a workgroup PC and you don’t know any local account passwords, there are plenty of bootable tools to just clear the passwords. ntpasswd is free but more complicated, but if you’re a shop with any amount of budget, something like ActiveDisk uses WinPE and it’s all GUI. Much easier.

3

Hi ranhalt. That’s a very good point you’re making, but I used this method when somebody forgot their domain administrator password, when friends forgot passwords for their own PCs and when we were moving PCs to another domain and nobody bothered to check if there was a local admin (we had no way to log in after they left the domain). Of course you will never need to use something like this if you are working with your own, well-managed system.
This helped me more times than I tought it would and I wanted to share it with you guys.

4

Ranhalt - this is a great method for isolated instances when you don’t have your other NT password utils with you - a workstation at the DMV that goes down while getting your license renewed, Grandma’s computer at Thanksgiving dinner, your wife’s school computer that hasn’t been fixed by the district IT staff in the last 3 weeks, a client site while you left your laptop bag at the office and don’t want to go back again… etc.

Also, this is a how-to, not a policy mandate. Criticism should be limited to errors and mistakes with the write-up, not whether or not it should be your “go to” procedure.

5

This method has the potential to destroy EFS-encrypted data. If you’re resorting to this method, you hopefully have a backup somewhere that is protected using something other than EFS.

6

I dont think this will work if bitlocker is on. or will it ?

This is great classic guide for changing password for local accounts, I dont think domain password can be changed this way.

7

Hi shiraza, I don’t know about Bitlocker, but you can definitely reset domain accounts. I reset a domain administrator account on a domain controller this way. If you already have the administrator credentials for the domain, you don’t need this for the users.

8

I’m assuming this works on Windows 10? Seems like its basically the same as the “SetHC hack” for Windows 7 where you do something very similar but press the shift key at login 5 times…