Passwords are a fickle thing; they protect our intellectual and digital assets from unwanted intruders, but for those rarely-used passwords, they can slip fleetingly from memory leaving us locked out of our own goods. Of all the passwords out there, those for Windows accounts are perhaps the most ubiquitous, and therefore it is commonly exclaimed: "HELP! Forgot my Windows password! WHAT DO I DO??"
You crack it, of course. Luckily for the lot of us, Microsoft's encryption for account passwords is mediocre at best, which leaves the end-user a significant quantity of traction in these matters. In order to proceed, the following materials are required:
- A secondary computer with a CD burner.
- The capability to successfully burn a bootable ISO.
- The fantastic NT Password Reset utility.
The year during which the project went dark has passed, and the 10-year anniversary edition from April, 2007 now works on any Microsoft product in the Windows NT-based family. Once you have this ISO burned to CD, reboot the computer and settle in for a bit of work at the CLI. Now all you have to do is follow this procedure step by step, and your NT password will be reset in no time:
Step 1: Starting the Tool
Just hit enter!
Step 2: Select the Partition
Where the program says "DISK /DEV/SDA: 320GB, 320071652352 BYTES," below that is the partition with Windows on it as described by "1: /DEV/SDA1 5113MB BOOT." When it says "Please select partition by number," you would select the number that has been assigned to that partition. Remeber "1: /DEV/SDA1" -- So in this case, type "1" and hit enter.
Step 3: Load the Registry
Now that the partition has been mounted, you will be prompted to select the location of your registry. As we can see at the bottom of the screenshot, [WINDOWS/SYSTEM32/CONFIG]" has been selected for us. Simply press enter.
Step 4: Choose to Edit Passwords
Here you will be prompted what you want to do with the utility now that you've loaded your computer's Windows partition and registry. Press "1" and hit enter to begin the password reset suite.
Step 5: Select the Account to Reset
Accounts are identified with their "RID," which is a four character HEX code preceded by "0x". In this case we are resetting the password for the "TEST" account, which has an RID of 0x03EC. All you must do is type the RID of the account you want to reset and hit enter. I have done so for the 0x03EC "Test" account.
Step 6: Blank the Password
Now that you have the account loaded, type "*" and hit enter. This will blank the password for the account and leave you an account with no login protection. This is often the best procedure.
Step 7: Confirm and Quit
"Do you really wish to change it? (y/n) [n]" -- The program is inquiring whether or not you'd actually like to change the password. Press "Y" to signify yes, and hit enter. At this point, you can also quit out of the password reset portion of the program by entering an exclamation point and hitting enter.
Step 8: Confirm Quit and Write Changes
Once you have entered the exclamation point, which exits you from your partition and registry editing, pressing "q" on the keyboard and hitting enter will prompt you to write the changes. "About to write file(s) back! Do it? [n] : " -- Hit "y" and then press enter. This will write the blanked account password back into the encrypted account database for Windows NT-based OSes.
Once you've written the changes back, you can remove the disc from your PC and reboot your machine. Getting back to the Windows login screen, you should be allowed to log right into your account with no password. This procedure, as a reminder, only works for Windows 2000, Windows XP, Windows Vista and Windows 2003; no other version of Windows is compatible with this boot disc. If you're still running Windows 98 or Windows ME, pressing "Escape" at the login screen will give you complete access to the PC without login credentials. Good luck!






A Better Solution
Just throw this live cd in and it preforms a dictionary attack on the weak lm/ntlm hash's (Since microsoft uses such a weak hashing scheme.. If they used MD5 like everyone else it would take a much bigger table).
edit: The main benifit of this method of this method is you don't lose any encrypted files you may have had.