up vote 0 down vote favorite
share [g+] share [fb]

I have a computer from another small organization that works with our school. It was previously joined to another domain from elsewhere. The organization doesn't have an IT person so they didn't think of what they needed to do about the information on the computer before they moved it to our school. The previous user of the computer is no longer with the organization so no information about the password.

The computer has information that needs to be accessed and programs so putting the hard drive on another computer and grabbing the information is a no go as I need the computer itself to be working as well. The computer is running Windows Vista Business Edition and is joined to a domain with a cached profile. The admin accounts are disabled by GPO.

I've been asked to see if I could recover the password but running ophcrack gave me no hits on the cached profile. I'm not too familiar with password recovery tools that would work on a cached profile from a domain so I'm looking for answers here. Any other suggestions? Preferably something free as we're a small school and an easy to use liveCD solution like ophcrack would be appreciated.

link|improve this question
feedback

4 Answers

up vote 1 down vote

http://www.piotrbania.com/all/kon-boot/

This is a little utility I keep in my desk at work. Lets you skip the login screen to windows.

link|improve this answer
Does this utility reset or change the password? I'm a bit afraid of that because I've heard there could be things that are tied to a password and things can unexpectedly break by forcing a password change thorough unofficial methods. I'd much prefer a password recovery option. – theguy Nov 4 '09 at 16:47
Does neither. When the login screen comes up you just leave the password blank, hit enter, and it logs in. You restart without the disc and it goes back to normal. – Skaughty Nov 4 '09 at 17:00
feedback
up vote 1 down vote

Cain can crack these, they're in the Cracker tab, called 'MSCache'. If you can't run it on the machine, boot a liveCD and copy of system32/config (you need two of the files, I think it's security and system, but get them all). You can then extract them from those (using Cain), and try to crack. Bear in mind that strong passwords will not be breakable.

Rather than cracking the cached credentials, couldn't you just reset the administrator password (lots of tools can do this, I've used ERD Commander and Hiren's Boot CD), and then login locally, rather than going to the domain login?

link|improve this answer
feedback
up vote 0 down vote

Does it log you in with administrator privileges??

link|improve this answer
feedback
up vote 0 down vote

Yes - blanking the Administrator password does allow you to log in with Administrator privileges. The tool I've used it chpasswd, a linux-based tool. It should also be able to blank or reset other local user password. You'd boot into a linux live cd or live usb to run this.

I do not currently know of a way to change a Cached Domain password.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard