1
vote

I'm not sure if this a serverfault or superuser question.

A client of mine shipped me a Windows 7 box that I am supposed to work on. Unfortunately the machine is joined to his domain (which I cannot access - legally or physically) and the local administrator account appears to be disabled.

Is there anyway that I can get into the system and enable/create a local account with administrator level rights given that I have physical access? Or is my only choice to ship it back and get my client to enable a usable account and ship it back to me again?

For what its worth this is Windows 7 professional.

Edit

As prompted by Chunkyb2002's answer about caching of domain credentials I forgot to mention that there is a domain user as being the last login. Presumably this person also set this computer up and potentially has admin rights. So given this new info is it likely that if I get the password that Windows 7 will let me log in?

Edit 2

I'm in with cached credentials!

7
  • 2
    So let me get this straight, you want to break into windows but a boot disk is too black hat for you. Would a privilege escalation exploit using buffer overflow in kernel level be okay? Or how on earth would you think of breaking into windows without using an exploit or a boot disk? This question is seriously wtf.
    – Rook
    Aug 27, 2010 at 21:23
  • 4
    @Peter, Have you considered simply calling your client and asking them how they want you to handle this? Tell them you can reset the password or send it back.
    – Zoredache
    Aug 27, 2010 at 21:34
  • @Zoredache - I am trying to work that angle as well, but Friday afternoons are frustrating. I didn't think that I needed to bother people here with non-technical details. What I am hoping to get here is a decent list of options.
    – Peter M
    Aug 27, 2010 at 21:38
  • What is it you are supposed to be doing on this box anyway? If it is hardware related, just replace the drive or use a livecd.
    – Zoredache
    Aug 27, 2010 at 21:39
  • @Zoredache - I am supposed to be installing and testing a combined software/hardware product that we are selling them. So replacing the hard drive and reinstalling Windows 7 is not something I really want to be doing (or wasting time on)
    – Peter M
    Aug 27, 2010 at 21:46

3 Answers 3

Reset to default
4
votes

PassWare can enable Administrator accounts but it's not free. Also domain computers will cache previous logins when it was attached to the domain so you could call the client and ask them for the last users login credentials (along with advising them to reset the password in question immediately).

The second option only helps you if the user in question has administrative rights.

Even with these options, I'd still not recommend doing so as the computer and OS doesn't belong to you. Call the client and ask them for guidance, chances are the IT department (or whoever runs their IT) forgot (or wasn't informed) that you'd be off the domain.

8
  • The credential caching was something that I had forgotten about. Thanks for that. I am exploring that option now.
    – Peter M
    Aug 27, 2010 at 21:31
  • Windows 7 will definitely let you login with the cached credentials. We used to have all of our laptops on the domain and advised users about user caching (and that they should connect to the network occasionally to get the latest credentials). If you can get that login info you'll be sorted :)
    – chunkyb2002
    Aug 27, 2010 at 21:39
  • I'm in with cached credentials! woo hoo!!
    – Peter M
    Aug 27, 2010 at 22:22
  • @Peter M and @chunkyb2002 can someone please explain how this is not an exploit?
    – Rook
    Aug 29, 2010 at 18:52
  • Depends on your definition of exploit I suppose. It is a feature so that users can still login to the OS when not connected to the Domain network. If the client was happy to supply the password then Peter is a trusted user and authorised to login to the computer.
    – chunkyb2002
    Aug 30, 2010 at 21:39
10
votes

You should ship it back and ask the client to set up a local admin user for you to work with.

Toward your edit:
If you can get the proper credentials then there's no reason that Windows shouldn't let you log in. There is no guarantee, though, that it is an admin account. Your chances might be good, though, if that account was used to set the machine up.

7
  • 3
    Exactly, any other way would be bad, even if it works. If I was your client I would not feel happy if you had hacked your way into your machine. It's the clients fault you don't have access, let the, sort it.
    – Sam Cogan
    Aug 27, 2010 at 20:58
  • @Sam Cogan you have a warped idea of what hacking is. This is a solution to a problem and no one is getting hurt.
    – Rook
    Aug 27, 2010 at 21:02
  • If the client shipped a machine and asked for work to be done on it, I hardly think this is "hacking".
    – Bill Weiss
    Aug 27, 2010 at 21:07
  • @SAm - I agree that this is the clients mess, but short time constraints etc force me to at least ask this question. Besides I almost don't even trust them to ship things properly - the machine arrived with the hard drives almost dangling inside the case and the power connector for the boot drive not being attached!
    – Peter M
    Aug 27, 2010 at 21:08
  • 1
    @Peter I can understand that, hopefully the client will be able to give you some cached credentials. Whilst using a boot disk or other tool may get you round this problem, in the long term it may cause you more problems than it solves.
    – Sam Cogan
    Aug 27, 2010 at 21:39
2
votes

This boot disk will allow you to change the administrative password on a Windows 7 machine. Make sure you call the guy and ask if this is okay! I have used it on older versions of windows and it works like a charm.

Also note that some viruses disabled the admin account on purpose to make it difficult to remove the infection. If this is the case you must reinstall.

30
  • 2
    -1 as I never advocate hacking into machines that aren't mine.
    – squillman
    Aug 27, 2010 at 20:59
  • 2
    The fact that the local admin account is disabled is proof that the client doesn't want the local admin account messed with. Thus hack. If permission was given to use the account then the account credentials would have been supplied.
    – squillman
    Aug 27, 2010 at 21:03
  • 2
    @rook - While I agree your solution does save money etc I have discounted it as it morally and ethically professionally questionable to even attempt your solution. When I am done the machine will end back inside the clients domain. If I use a boot disk method without being able to implicitly trust it then the trustworthiness of this machine is then brought into question. And rightly so.
    – Peter M
    Aug 27, 2010 at 21:05
  • 2
    Local administrator account is disabled by default in Windows 7.
    – David Mackintosh
    Aug 27, 2010 at 21:06
  • 3
    @Rook - some of us are professionals, working in professional environments. What you suggest may be perfectly acceptable working out of your parents basement, but for the rest of us it's a no-no.
    – Izzy
    Aug 27, 2010 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .