Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've managed to get into a loop hole and cannot find a way out.

I have a server using Microsoft Virtual Server 2005 that I recently had to restart, so I shutdown all of the guests Virtual Machines and then restarted the host.

There are about 8 virtual machines in total, one of which is an Active Directory domain controller.

About a week ago, I also went around all of the servers (both physical and virtual) to disable the local accounts, including Administrator, as the domain appeared to be working fine.

However, now that the physical host server has restarted, I cannot logon any longer via remote desktop - as the domain is not contactable (due to the virtual machine being powered down) and the local administrator account is disabled.

I have tried connecting from another physical server (via Computer Management) to try and re-enable the local accounts, but I don't have permission (and/or RPC appears to be blocked - again, via Domain Controller group policy). I've tried connecting to Virtual Server 2005 to switch on the Domain Controller VM - but again, no accounts with access.

How can I get out of this? I need to switch all of the VMs on ASAP!

share|improve this question
To clarify - this isn't a mission critical server, but it does host my email and various personal websites. I'll try methods that require physical access once I return home. – Lazlow Jun 24 '09 at 11:03
pauska's suggestion of booting into Safe Mode resolved the issue. I've re-enabled the local administrator account on both physical servers, so that this doesn't happen in future! – Lazlow Jun 24 '09 at 19:33
up vote 5 down vote accepted

Boot it up in safe mode and re-enable the local Administrator account.

Do-not-ever disable it again, assign it a crazy password, write it down on a note and lock it away if something like this happends again.

Also, don't virtualize all your basic networking services (like a domain controller). Install windows server on a old PC, configure it as a domain controller, global catalog, DNS and DHCP (if you use DHCP), and place the PC somewhere else in the building.

share|improve this answer
Great suggestion, if all else fails I'll do this tonight. Slight problem - I'm working remotely via Remote Desktop (and VMRC for Virtual Server), so cannot use safe mode (as far as I'm aware). – Lazlow Jun 24 '09 at 10:55
You don't have physical access at all to the server? Can you call someone to do this for you? – pauska Jun 24 '09 at 10:56
I can call my wife, but explaining how to boot into safe mode is a bit too far - hitting the reset button is as far as it goes. – Lazlow Jun 24 '09 at 11:02
At the very least, have multiple domain controllers running on separate virtual hosts – Matt Simmons Jun 24 '09 at 11:44
This is why you should always have at least one physical domain controller, or use a VM solution that doesn't rely on your DCs being online. – mrdenny Jun 24 '09 at 15:34

(I didn't even think of safe mode!)

You could try using EBCD to re-enable the admin account. I've used it in the past when i've lost local admin passwords, works great.

As the other post says - you shouldn't disable the local admin accounts - rename the account to something random and put a very strong password on it if you're concerned. Also, you really should consider maintaining a physical domain controller - perhaps the host machine itself?

share|improve this answer
Are you referring to Emergency Boot CD ( If so, again I'll try that if all else fails remotely. – Lazlow Jun 24 '09 at 10:56
Safe mode is sufficient for re-enabling it, as it allows local logon even if the account is disabled. – pauska Jun 24 '09 at 10:58
Thanks for the clarification. – Lazlow Jun 24 '09 at 11:03
You can get free versions of EBCD if you look around - or try – Chris W Jun 24 '09 at 11:03

Petter Nordahl's Offline NT Password & Registry Editor can re-enable the Administrator account and assign it a new password. The safest method is to disconnect the network and give the account a blank password (by entering an asterisk ... * ), then change to a better password on boot, and then reconnect network.

It takes about ten minutes to download and burn the disk; less if you use the floppy version.

Since you're using virtual systems, you don't even have to burn. Just boot from the .iso file.

share|improve this answer
I'm not sure if it would provide any benefit over using Safe Mode to re-enable the local administrator account. However, thanks for the answer. – Lazlow Jun 24 '09 at 11:30

When you get back to physically infront of the host machine, unplug the network cable.

Then try to login using the domain administrator account again

Windows should use the cached domain login (assuming you've logged in using administrator atleast once recently to it, and you don't have some GPO preventing login if no DC is online) Much like when a laptop is not on the network, once in get things working again.

Once done, as a thought, does the host machine need to be one the domain?

Could it simply be a workgroup computer & then you have a renamed admin account and a crazy password?

That way you'll always have access to it regardless of what the domain is doing.

share|improve this answer
Hrm, since the DC VM is powered down, it should be behaving as if it's unplugged anyway, I'd think? – Kara Marfia Jun 24 '09 at 12:17
For the first 6 months of operating, the host machine wasn't on the domain - and no virtual/physical machines on the network accessed it. However I recently added it to the domain to gain the benefits of the domain group policy and firewall rules. I may remove it completely from the domain, or move AD to another dedicated physical server. – Lazlow Jun 24 '09 at 12:18
Kara - I thought exactly the same thing. However, I've had the same issue in the past with it not being able to logon using a domain account after restart - in those sitatuons I logged on as the local administrator. – Lazlow Jun 24 '09 at 12:20
If the VM DC is powered down, not always :) Since it's detecting a network it may trying to look for it and think it is on the network and give you the domain controller un-available. In which case its not using the cached login. I had this happen to be once when I forgot the local password for a workstation at a remote site with no DC. Even though the VPN was down (and as such no DC) until I unplugged the network it wouldn't use the cached login. – SpaceManSpiff Jun 24 '09 at 12:55

Her's a little trick, you boot a livecd (take a look at backtrack) with read/write access to the ntfs volume, then you rename windows/system32/logon.scr to logon.bak and copy cmd.exe to logon.scr.

You reboot the machine and wait a few minutes, instead of launching the logon screensaver , it will launch a shell under system credentials. then:

c:>net user new_account new_password /add
c:>net localgroup administrators new_account /add

now you got a new local admin account on the box.

By the way i think it is a good practice to make a second local admin account and disable the original one

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.