Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Windows XP workstation we cannot login to (with any account). The old admin for the system left.

At first we ran a linux live CD with a password reset tool. This appears to have reset the password of the admin account to blank, but when we booted into windows and tried to login we get an invalid login prompt.

Then we tried resetting another users password to something that was not blank and elevated his account to admin, same issue, cannot login.

Then I tried the hack where you rename cmd.exe to utilman.exe, bootup into windows and then press Windows + U to bring up the command prompt... nothing happens. We get a beep, and then nothing, even after letting it sit for a while (I figured it may take a while to bring up the command prompt). utilman.exe does normally execute with this key press so I know it is not disabled.

I also tried renaming cmd.exe to magnify.exe and I tried renaming explorer.exe to utilman.exe, neither of those bring up anything.

So what is wrong with the system? Why can we not execute cmd.exe from the login window?

Thanks,

Jon

share|improve this question
    
Which operating system? –  Massimo Feb 12 '13 at 19:30
    
Windows XP, sorry. :D –  MasterZ Feb 12 '13 at 19:32
    
Sounds more as if a virus hosed the system. –  Tonny Feb 12 '13 at 19:32
    
@Tonny, well, it is Windows..... :D –  MasterZ Feb 12 '13 at 19:37
    
@MasterZ I just finished re-installing 2 systems because of a trojan. Malvertizing drive-by download by a plugin in a toolbar that got installed as side-effect of an utility that shouldn't have been on those boxes in the first place. And then people still ask me why I grumble about Windows.... –  Tonny Feb 12 '13 at 20:52

2 Answers 2

up vote 2 down vote accepted

At this point, your most effective option would be to either do a repair install, or mount the disk from another OS (your LinuxLive CD or physically put it in another machine as a secondary drive) and copy what you need off of it, and just rebuilt it later.

share|improve this answer
    
We are attempting to do that but there is a lot of confusion as to what agency actually "owns" the machine and the software that is on it so nobody is wanting to provide us with a fresh disk image. I figured hacking the system would be easier to do while management works out the politics of the stupid system. –  MasterZ Feb 12 '13 at 19:37
    
OK - since you didn't actually name your business goal in the question, I assumed it was simple data recovery. –  mfinni Feb 12 '13 at 19:59
    
I think the file is corrupt. I was able to bring up the cmd prompt and then the user manager while using the recovery CD. But it kept failing when I tried to make any changes to a user, no password updates or anything. I was able to create a new user account however, and still it would not let me login. –  MasterZ Feb 12 '13 at 23:38

Using your LiveCD, get the SAM file off of the file system (%SystemRoot%\System32\config\SAM) and then run it through John the Ripper (link) to crack the password(s). Simples.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.