Friday, February 26, 2010

Some things to remember when approaching the problem of lost XP password or account locked out

Results of research from Unable to log you on because your account has been locked out.

For some cases (which look a little bit like home PC cases) the default security policy ("Group Policy") is that this type of too many tries lockout has a timeout, usually 15 minutes. This is probably not the case for the work PC's though.

Past solutions to a lost Admin password has been to use an online service which cracks a few characters of the password from some file on the PC. I can't quite remember which service we used for this a few years ago. However, here's a great list of a whole range of solutions at the site where I think I found our cracking service before (such memorable sarcasm): http://www.petri.co.il/forgot_administrator_password.htm

Here are a few neat hints that I've stumbled across that deserve further study:

Here is a floppy-based password reset tool. There are probably thousands of these:
NTpasswd: http://pogostick.net/~pnh/ntpasswd/

In fact, this site lists five, some of which are also covered by Petri above, and includes the currently popular Ophcrack: http://pcsupport.about.com/od/toolsofthetrade/tp/passrecovery.htm

If it is possible to log in as administrator in safe mode, (the website describes this as "restart your computer in safe mode -administaror account". It probably still requires the administrator password.) some commands which allow reconfiguration of the user accounts' passwords are:
click "start"-"run", type "control userpasswords2" hit enter
you will get a new window
select your user name
click on "reset passwords" button
restart your computer in your normal user account
(from http://www.techsupportforum.com/microsoft-support/windows-xp-support/250118-windows-xp-pro-user-accounts-locked-out.html)


This forum thread: http://forums.techarena.in/windows-security/949834.htm
has all kinds of neat tips, like the proper tool for editing the group policies (gpedit.msc, I should know this stuff) and the policy for enabling auditing of failed login attempts (hell yeah I always want that). Also how to disable fast user switching by disabling the Welcome login screen. Also stuff about hiding and unhiding accounts in the Welcome screen, and the way it normally behaves and misbehaves.

This forum thread: http://en.kioskea.net/forum/affich-80647-locked-out-of-admin-account
Reveals some mindblowing command line options for changing users' group settings. There's probably a whole lot more stuff that can be done aside from the following:
Do you have any other accounts becaus if you do
open cmd and type net user
A list of users will show.
next type net localgroup administrators [the name of an other acount here] /add
Then hit enter this will make the other user an administrator. Then you can sort your self out from there.