Unfortunately, I've forgotten the password to both the local admin account and the domain admin account on my domain controller. This box is to be used in an exploitation demonstration but the passwords are still required to setup the vulnerable services. What are my options here?
I've attempted to liveboot a few password recovery tools via cd boot but they don't seem to work (it's probably me using them incorrectly). I've attempted to map the drive to my host machine to crack hashes from the SAM file locally/offline but the SAM file requires specific permissions that I do not have on the host machine. I feel like there are additional security protections in place with this being a domain controller, something I do not have experience with in terms of forensics and recovery. Is there an easy path to recovering the passwords for both accounts or even retrieving the hashes of those passwords?
Note: there is a similar question on this but the answer is not present in the thread so I'm asking again. Also, this server is part of a domain (it's the controller) so that's something different to consider compared to the other question.