A friend of mine generated a new Administrator password for our Windows server with KeePass. At the same time, my... er... his PC manufacturer's auto-update was installing new graphics card drivers. I'm sure you can see where this is going — the password was successfully changed at the server and then the graphics card driver update failed, resulting in a crash before the generated password was saved in the KeePass database. Schoolboy error, I know.

My host provides a recovery mode for Windows, but for some reason it won't boot (of all the luck) and they're taking forever to look into it. I can boot into a Linux (debian) recovery system and mount the Windows drive, so I'm wondering if there's anything I can do from there? My Linux knowledge is pretty poor, I know there's chntpw but I'm not sure how to install it (apt-get is available, but I don't know which source to add or how to add it).

I've seen similar questions but they all involve having physical access to the machine. The responses to those questions are usually:

  • Boot into the recovery system and replace one of the accessibility executables with cmd.exe, then use the key combination at the logon screen.
    I don't think I can do this because I can't access the logon screen via Remote Desktop. I'm always asked for credentials before the connection is complete.

  • Use chntpw from Linux to change the password.
    As mentioned above, my experience with Linux command line is poor. Aside from this, I've heard that it changes machine passwords only and I'm not sure if the Administrator is an Active Directory account.

As a last resort I can re-image the machine but I spent the last week setting everything up and I'm hoping I can avoid all that time spent being for naught. I can use PuTTY for terminal and WinSCP to play around with the files if that helps.

Does anyone have any suggestions?

Update - I can now access the Windows Rescue System via TightVNC. However, all the commands apply to this separate instance of Windows - how can I change/recover my password on the main Windows installation?

  • Is the Windows machine on Active directory or no? If it's on AD, it won't have a local administrator account. Mar 1, 2011 at 0:06
  • @Bart: I'm embarrassed to say I'm not sure. It's just a dedicated server with 1and1, I'm not savvy enough to know the difference. The Administrator account is in the SAM file, if that helps at all.
    – Andy E
    Mar 1, 2011 at 0:10
  • I'm protecting this question since [password-recovery] attracts the spam-bots. Do continue...
    – sysadmin1138
    Mar 1, 2011 at 0:33
  • @Bart: A domain member computer will have a local administrator account. Domain controllers don't have local administrator accounts.
    – joeqwerty
    Mar 1, 2011 at 0:43
  • @Joeqwerty: you're right, I should have been more clear. I meant DC when I said that earlier (can you see my cheeks turn red for not being more clear? Sorry Andy...) Mar 1, 2011 at 2:29

3 Answers 3


I'm not familiar with what out of band management a server from 1&1 might have but if there is anyway you can attach an ISO and boot from it the Microsoft DaRT (Microsoft Diagnostics and Recovery Toolset) ISO can reset the passwords.


  • I'm guessing DaRT is part of MDOP which doesn't have a direct download link...? If it has this many acronyms and steps to figure out how to get the @#$% thing it makes me wonder if I'd want to mess with it :-/ Mar 1, 2011 at 2:32
  • You can download it for free if you have MSDN or Technet access. Ultimately what is contains is the old WinInternals LockSmith utility (amongst others) and this tool works very well to reset the admin password.
    – Ausmith1
    Mar 1, 2011 at 2:36
  • I can access the serial console, but all it allows me to do is list/kill processes, play with the IPv4 stuff and restart the server. I can boot into the rescue system, which looks like some sort of PE loaded into RAM across the network. It has Firefox and File/FTP Managers, but I'm not sure how I could reset the password.
    – Andy E
    Mar 1, 2011 at 10:51

It seemed like, in the end, the best approach would be to initialise the server. I was wasting a lot of time trying to get access back and I'm not convinced at this point that it was possible to do remotely. I spent a good 16 hours or so trying to crack or disable the password using various outlets like the serial console or the Windows/Linux rescue systems and had no luck whatsoever.

Re-imaging my server took 1 hour and then I spent the rest of the day restoring backups and installing software. If I'd done that to start with I'd be asleep right now, so lesson learned.

  • 1
    Have to go with this - sometimes the pragmatic approach is to just take an hour to rebuild something rather than 2 hours to "fix" it.
    – Rob Moir
    Mar 2, 2011 at 11:02
  • ...and I still didn't get the damn graphics card driver installed properly. Stupid Vaio Update.
    – Andy E
    Mar 2, 2011 at 11:54

This is just a wild shot in the dark.

If you have out-of-band mgmt such as DRAC or iLO, from linux, you could make a copy of winlogon.exe and then copy cmd.exe over winlogon.exe. If the server is rebooted, maybe you will have a command prompt running as the SYSTEM account. From this, admin you could change the password or create a new admin account. Afterwards, you could replace winlogon.exe with the correct version (from within linux).

  • If I did that, I don't think I'd be able to connect via RDP, would I? Doesn't it require winlogon.exe?
    – Andy E
    Mar 1, 2011 at 0:46
  • This would not work with RDP. You would need OOB management.
    – jftuga
    Mar 1, 2011 at 0:52
  • I have serial console access, but it requires the admin password to log on, so I guess that doesn't help?
    – Andy E
    Mar 1, 2011 at 0:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.