Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to log into Windows using a USB stick? (on Windows XP/7)

I have student workers whom I would like to give admin rights for maintenance, but I would like to refrain from giving out a password for various reasons (students joining and leaving the staff, students writing them down and losing them, etc). This would also allow me to keep track of who and when a student worker is allowed admin access.

share|improve this question
up vote 1 down vote accepted

There's a "hacking" dongle out there that acts as a HID keyboard and can be programmed to act on events and send keypresses to a computer...

...but I fail to see how you get accountability or track-keeping with a physical artefact without some added personal knowledge like a password or a pin number or if it's truly one-use only. The stick could easily be lent, borrowed, copied and so on unless you personally watched over it and if the password was shared there's no accountability and no incentive to keep it private for any possessor.

If there's central user administration I'd just go with creating and handing out personal accounts for those who need them, separate administrative accounts as well (or grant the regular accounts the permissions needed when needed). You could then enable and disable them at will and with some decent-level speech about personal accountability they won't be shared as often as a stick.

share|improve this answer
Right, I was going to look into copy protection once I found a method that actually worked. – Force Flow Jul 8 '10 at 18:20

You want a Windows PKI USB Token. You can assign a passworded certificate to it, then control through Cert-to-User mapping. When they're done, you revoke the cert (or only make it valid in the first place for a week). If they lose it, you have to replace the Token, but no big deal. Still make them a separate User-Admin account (usually their standard login, with "-admin" appended) and give that account admin access.

If you need more details on how to set this up let me know, and I'll post more.

share|improve this answer
Sounds interesting, but the cost is certainly much higher than I was willing to spend :( – Force Flow Jul 8 '10 at 18:20
Yeah, that typically happens. Features + Convenience = Cost – Chris S Jul 9 '10 at 12:28

If you have a little budget for it, have a look at Yubikey ( It's a very cheap device designed specifically for this purpose. They worked very well for my needs.

share|improve this answer
+1 Something with a one-time-password seems like a great idea in this case – Oskar Duveborn Jul 8 '10 at 0:04
Interesting device, I'm not sure I'd consider $25 that much cheaper compared to PKI Tokens. – Chris S Jul 9 '10 at 12:36

use konboot, you can login to windows without a password, just need to know the username. tested on all os's from 2000 and up to 7 / all server revisions also. This also works if you have novell client installed, however i have never tested with Active Directory.

you just need to take a usb stick, install grub4dos to make in bootable and then download the floppy image of konboot, mix it all together and voila, you can login into and windows workstation/server and even linux (but i will not give a tutorial on that)

peace out!

share|improve this answer
I'll have to take a look and give this a whirl :) – Force Flow Jul 8 '10 at 18:21
This does not work on AD, it'll get you into the workstation; but you will have no rights on the network. – Chris S Jul 9 '10 at 12:29
Rats, this won't work then. Network access would be needed. – Force Flow Jul 16 '10 at 14:55

You can transform an USB Key into a smart card using EIDVirtual, then use active directory smart card login or EIDAuthenticate on stand alone computer.


share|improve this answer

protected by Tom O'Connor May 14 '14 at 8:32

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.