Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not sure if this a serverfault or superuser question.

A client of mine shipped me a Windows 7 box that I am supposed to work on. Unfortunately the machine is joined to his domain (which I cannot access - legally or physically) and the local administrator account appears to be disabled.

Is there anyway that I can get into the system and enable/create a local account with administrator level rights given that I have physical access? Or is my only choice to ship it back and get my client to enable a usable account and ship it back to me again?

For what its worth this is Windows 7 professional.


As prompted by Chunkyb2002's answer about caching of domain credentials I forgot to mention that there is a domain user as being the last login. Presumably this person also set this computer up and potentially has admin rights. So given this new info is it likely that if I get the password that Windows 7 will let me log in?

Edit 2

I'm in with cached credentials!


locked by HopelessN00b Mar 16 '15 at 17:20

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

So let me get this straight, you want to break into windows but a boot disk is too black hat for you. Would a privilege escalation exploit using buffer overflow in kernel level be okay? Or how on earth would you think of breaking into windows without using an exploit or a boot disk? This question is seriously wtf. – Rook Aug 27 '10 at 21:23
@Peter, Have you considered simply calling your client and asking them how they want you to handle this? Tell them you can reset the password or send it back. – Zoredache Aug 27 '10 at 21:34
@Zoredache - I am trying to work that angle as well, but Friday afternoons are frustrating. I didn't think that I needed to bother people here with non-technical details. What I am hoping to get here is a decent list of options. – Peter M Aug 27 '10 at 21:38
What is it you are supposed to be doing on this box anyway? If it is hardware related, just replace the drive or use a livecd. – Zoredache Aug 27 '10 at 21:39
@Zoredache - I am supposed to be installing and testing a combined software/hardware product that we are selling them. So replacing the hard drive and reinstalling Windows 7 is not something I really want to be doing (or wasting time on) – Peter M Aug 27 '10 at 21:46
up vote 4 down vote accepted

PassWare can enable Administrator accounts but it's not free. Also domain computers will cache previous logins when it was attached to the domain so you could call the client and ask them for the last users login credentials (along with advising them to reset the password in question immediately).

The second option only helps you if the user in question has administrative rights.

Even with these options, I'd still not recommend doing so as the computer and OS doesn't belong to you. Call the client and ask them for guidance, chances are the IT department (or whoever runs their IT) forgot (or wasn't informed) that you'd be off the domain.

The credential caching was something that I had forgotten about. Thanks for that. I am exploring that option now. – Peter M Aug 27 '10 at 21:31
Windows 7 will definitely let you login with the cached credentials. We used to have all of our laptops on the domain and advised users about user caching (and that they should connect to the network occasionally to get the latest credentials). If you can get that login info you'll be sorted :) – chunkyb2002 Aug 27 '10 at 21:39
I'm in with cached credentials! woo hoo!! – Peter M Aug 27 '10 at 22:22
@Peter M and @chunkyb2002 can someone please explain how this is not an exploit? – Rook Aug 29 '10 at 18:52
Depends on your definition of exploit I suppose. It is a feature so that users can still login to the OS when not connected to the Domain network. If the client was happy to supply the password then Peter is a trusted user and authorised to login to the computer. – chunkyb2002 Aug 30 '10 at 21:39

You should ship it back and ask the client to set up a local admin user for you to work with.

Toward your edit:
If you can get the proper credentials then there's no reason that Windows shouldn't let you log in. There is no guarantee, though, that it is an admin account. Your chances might be good, though, if that account was used to set the machine up.

Exactly, any other way would be bad, even if it works. If I was your client I would not feel happy if you had hacked your way into your machine. It's the clients fault you don't have access, let the, sort it. – Sam Aug 27 '10 at 20:58
@Sam Cogan you have a warped idea of what hacking is. This is a solution to a problem and no one is getting hurt. – Rook Aug 27 '10 at 21:02
If the client shipped a machine and asked for work to be done on it, I hardly think this is "hacking". – Bill Weiss Aug 27 '10 at 21:07
@SAm - I agree that this is the clients mess, but short time constraints etc force me to at least ask this question. Besides I almost don't even trust them to ship things properly - the machine arrived with the hard drives almost dangling inside the case and the power connector for the boot drive not being attached! – Peter M Aug 27 '10 at 21:08
@Peter I can understand that, hopefully the client will be able to give you some cached credentials. Whilst using a boot disk or other tool may get you round this problem, in the long term it may cause you more problems than it solves. – Sam Aug 27 '10 at 21:39

This boot disk will allow you to change the administrative password on a Windows 7 machine. Make sure you call the guy and ask if this is okay! I have used it on older versions of windows and it works like a charm.

Also note that some viruses disabled the admin account on purpose to make it difficult to remove the infection. If this is the case you must reinstall.

locked by splattne Aug 28 '10 at 7:32
-1 as I never advocate hacking into machines that aren't mine. – squillman Aug 27 '10 at 20:59
The fact that the local admin account is disabled is proof that the client doesn't want the local admin account messed with. Thus hack. If permission was given to use the account then the account credentials would have been supplied. – squillman Aug 27 '10 at 21:03
@rook - While I agree your solution does save money etc I have discounted it as it morally and ethically professionally questionable to even attempt your solution. When I am done the machine will end back inside the clients domain. If I use a boot disk method without being able to implicitly trust it then the trustworthiness of this machine is then brought into question. And rightly so. – Peter M Aug 27 '10 at 21:05
Local administrator account is disabled by default in Windows 7. – David Mackintosh Aug 27 '10 at 21:06
@Rook - some of us are professionals, working in professional environments. What you suggest may be perfectly acceptable working out of your parents basement, but for the rest of us it's a no-no. – Izzy Aug 27 '10 at 21:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.