Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Sometimes (e.g. when inspecting malware infested machines) it is very useful to be able to log in as a domain user without knowing the user's password with the computer off-line. How to do it? In every case, a local computer administrator account is available.

One option I am aware of involves dumping the cached domain credentials and then cracking them, but that means that password is no longer secret and sometimes is simply not practicable. In linux/unix, I would just do sudo -u 'johndoe' and be done. What's the equivalent in Windows XP/Vista/7?

Edit: just to provide context. This is for inspecting malware infected machines. Some malware will only start if you log on as the originally infected user. I can't put it back on the network to reset the password as it would be too risky. So, the box is off-line and I have a local admin account which is created at install time for troubleshooting.

share|improve this question
    
Log in as the Administrator and go ahead. It works. –  mailq Dec 6 '11 at 0:03
    
@maliq - Eh? What works? –  Konrads Dec 6 '11 at 8:52
add comment

4 Answers 4

There is no su in the windows world.

The only option short of getting the user to login is to change the user's password in active directory.

share|improve this answer
add comment

It is possible with managed (.Net) custom code. Beginning with Windows 2003/XP, there is a feature called S4U, that enables impersonation without credentials or an existing token.

I'm not providing a code sample, but if you know someone that can code this is fairly straightforward.

So the upshot is it is possible to run something like impersonate.exe [domain\username] and open a new command prompt in that user's identity. Is that what you had in mind? If so, you may want to close this and open a new question on stackoverflow.com.

share|improve this answer
add comment

Let me rephrase your question ... if I am not correct please advise.

How can I log in to a machine with administrative privileges when it is off the network?

The most straight-forward option (in advance) is to setup Group Policies that force the local administrator password to a known password. Then, even if the PC is off the network, the local admin account will be available.

share|improve this answer
add comment

http://pogostick.net/~pnh/ntpasswd/

I recommend this. Burn it to a disc/flash drive and go for it.

share|improve this answer
1  
Only works for local accounts, in a domain environment there are precious few of them (thankfully). –  Mark Henderson Dec 6 '11 at 1:32
    
That tool resets local accounts. Did you read the question? –  MDMarra Dec 6 '11 at 1:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.