Sometimes you need to access the local Administrator account on a Windows XP, Vista or 7 machine, but either password was set and never recorded anywhere you have access, or it was just forgotten or lost.  If you have no other recourse than trying to hack your way in, there are a couple easy ways to access the Administrator account for Windows XP, and one for Windows Vista and Windows 7.

It’s important to note that changing any password for an encrypted (“private”) account will render any items saved in the account unreadable (eg, “My Documents”) as they use the password as an encryption key.  However this shouldn’t be an issue in the majority of cases for the Administrator account.

If the account documents are vital, as a last resort the Administrator password can usually be cracked using tools such as ophcrack, which can be run either from within Windows or from a Live CD.  My Solutions IT does not condone password cracking except as a last resort for account recovery; any requests for assistance with illegal hacking activity will be reported to the proper authorities immediately.

Changing the Administrator Account Password from Windows

This is the easiest and fastest method.  So long as you have access to a local “Computer administrator” account on the Windows XP box, you can simply change the Administrator account password from the User Accounts control panel.

The local Administrator account doesn’t normally show up in the User Accounts control panel, but you can use Microsoft’s TweakUI Windows XP Power Toy for Windows XP to show the local Administrator account by going to the “Logon” entry in the navigation tree and checking the box labeled “Show Administrator on Welcome Screen”:

TweakUI Windows XP Show Adminstrator Account

You may need to log out and log back in again or restart Windows before the Administrator account appears in the User Accounts control panel.  For Windows Home, you may also have to boot into Safe Mode in order to view the account.  Once it does appear in the User Accounts control panel, you can then change the password to something else, or remove it completely:

Windows XP User Accounts Control Panel Administrator Account:  Change Password

Changing the Administrator Account Password from a Live CD

If you can’t change the password from within Windows XP or are running Windows Vista or Windows 7, changing the password from a live CD such as SystemRescueCD or UBCD4Win is your best option.  UBCD4Win has a nice interface and tools, but the CD itself can be difficult to create so for this example we will be using SystemRescueCD.

After creating the CD and booting, you can reset the Administrator account password quite easily:

  1. Make the Windows installation accessible to the live CD.  Assuming that there is only one standard Windows system on an NTFS partition (hard drive device sda, partition 1):
    ntfs-3g /dev/sda1 /mnt/windows –o force
  2. Access the Windows system directory where the SAM password file lives:
    cd /mnt/windows/Windows/System32/config
  3. Use the chntpw utility on the SAM password file to list the available accounts; make sure that “Administrator” is actually listed (note that the command line switch is a lower case “L”, not the digit one):
    chntpw –l SAM
  4. Use the chntpw utility on the SAM password file to change the Administrator account password:
    chntpw –u Administrator SAM
  5. A text based wizard with several options will be displayed.  Usually the easiest and safest option is “1 – Clear (blank) user password”, so we will use that in this example.
  6. The wizard will then prompt you to “Write hive files?”  Enter “y” to write the password blank changes to the SAM file.
  7. You should now be done, with the Administrator account blanked.  Enter the reboot command to exit the live CD:

Your Administrator account should now be accessible using a blank password. 

Related Posts
I dislike Ubuntu's built in remote desktop service, and use x11vnc instead. Recently I was having a terrible time recently remotely accessing an Ubuntu+Gnome workstation: when I connect from a ...
We've recently started seeing Windows 8 touch screen devices come in, and so have been experimenting with them to get a good grip on the best ways to support and ...
Mounting your MTP Android’s SD Card on Ubuntu
Since Honeycomb, Android devices have starting using MTP (Media Transfer Protocol) instead of the straight up USB Mass Storage (UMS) file transfer system - creating massive headaches for most Linux ...
With Microsoft Windows 8 hitting the market, everyone has a review! Well, who are we to argue?  Here's our take on Windows 8 for small to medium sized businesses and ...
PhpStorm 5 & PhpStorm 6: Setting Up Remote Debugging
JetBrains' IDEs such as PhpStorm have always been top notch tools for developers, offering a wealth of features.  Unfortunately this same wealth can also become an embarrassment of riches when ...
Getting Shift Key Working With x11vnc and VNC
Windows 8 Translation Guide – Transitioning to the
Mounting your MTP Android’s SD Card on Ubuntu
Windows 8: Is it for you? Probably not.
PhpStorm 5 & PhpStorm 6: Setting Up Remote