Johnny Helpdesk

At some point, just about every IT professional has run into the task of recovering or resetting a password for a user on an operating system. Even many home users have run into this issue. It happens--people forget passwords!

The forgotten password can be for a regular user or administrator; on a standard file system, or an NTFS Encrypting File System. The question then becomes, "What do I do?"

Fortunately, there are a number of mechanisms available to deal with the lost password scenario, both in terms of proactive measures as well as disaster recovery tools and techniques.

If we assume that a user has not undertaken any proactive password recovery measures in advance, then we can immediately look at our disaster recovery options. In this case, we want to examine our options for account access and/or data recovery.

If the account in question was not using EFS, one commonly performed disaster recovery option is to yank the hard drive, install it as a slave on another system and recover the important data. Most people, however, prefer to avoid this if possible. It's a process which can involve a lot of time, work, a possible system rebuild and a good chance that at least some customization of the user's data or workspace will be lost in the process.

A better solution would be to regain access to the user's account so that it was as if the user hadn't lost access in the first place. There are actually quite a few tools on the market which can perform a password reset or change on an NT based system (Windows NT, 2000, XP, Vista). Some of these tools are commercial and others are non-commercial and/or open source (GPL or similar). I personally prefer non-commercial or open source software when there is something available which competes well with a proprietary brand.

A good example of an open source non-commercial piece of software which is up to the task of resetting an NT based password for us is Petter Nordahl-Hagen's "NT Password Editor." This piece of software can be downloaded as an ISO image and burned to CD. Then, when a password is forgotten, the CD can be used to boot from and change the NT account password from outside of the Windows operating system.

Petters password change utility runs on top of the Linux operating system. For most common hardware setups the boot process is very straightforward and does not require much, if any, tinkering or tweaking. So, let's give it a go and try to reset a few Windows Vista Administrator passwords.

In Figure 1 below, I show that I have set up two Vista Administrator Accounts: one named "standard_admin", and the other named "efs_admin."

You can click on any of the images in this blog to pop up a full sized image--be sure to allow pop ups in your browser for this website!

The first account does not use EFS; however, the second account does. I have placed a lorem ipsum test data file in each account's "My Documents" folder. I have applied encryption to this file on the efs_admin account. The two lorem ipsum files for each user account are shown below in Figures 2 and 3.

Figure 2	Figure 3