up vote 2 down vote favorite
share [g+] share [fb]

Sometimes (e.g. when inspecting malware infested machines) it is very useful to be able to log in as a domain user without knowing the user's password with the computer off-line. How to do it? In every case, a local computer administrator account is available.

One option I am aware of involves dumping the cached domain credentials and then cracking them, but that means that password is no longer secret and sometimes is simply not practicable. In linux/unix, I would just do sudo -u 'johndoe' and be done. What's the equivalent in Windows XP/Vista/7?

Edit: just to provide context. This is for inspecting malware infected machines. Some malware will only start if you log on as the originally infected user. I can't put it back on the network to reset the password as it would be too risky. So, the box is off-line and I have a local admin account which is created at install time for troubleshooting.

link|improve this question
41% accept rate
Log in as the Administrator and go ahead. It works. – mailq Dec 6 '11 at 0:03
@maliq - Eh? What works? – Konrads Dec 6 '11 at 8:52
feedback

4 Answers

up vote 5 down vote

There is no su in the windows world.

The only option short of getting the user to login is to change the user's password in active directory.

link|improve this answer
feedback
up vote 1 down vote

It is possible with managed (.Net) custom code. Beginning with Windows 2003/XP, there is a feature called S4U, that enables impersonation without credentials or an existing token.

I'm not providing a code sample, but if you know someone that can code this is fairly straightforward.

So the upshot is it is possible to run something like impersonate.exe [domain\username] and open a new command prompt in that user's identity. Is that what you had in mind? If so, you may want to close this and open a new question on stackoverflow.com.

link|improve this answer
feedback
up vote 0 down vote

Let me rephrase your question ... if I am not correct please advise.

How can I log in to a machine with administrative privileges when it is off the network?

The most straight-forward option (in advance) is to setup Group Policies that force the local administrator password to a known password. Then, even if the PC is off the network, the local admin account will be available.

link|improve this answer
feedback
up vote -2 down vote

http://pogostick.net/~pnh/ntpasswd/

I recommend this. Burn it to a disc/flash drive and go for it.

link|improve this answer
1  
Only works for local accounts, in a domain environment there are precious few of them (thankfully). – Mark Henderson♦ Dec 6 '11 at 1:32
That tool resets local accounts. Did you read the question? – MDMarra Dec 6 '11 at 1:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.