-3

I am referring to Windows 7/ Windows XP. Once a user account is locked (windows key + L)/ or logged off, is there anyway to get access to the users' files? Or anyway possible to break into the account?

3
  • An administrator cold easily access the HDD via the network; the workstation being locked would be no effect on those actions. Apr 29, 2015 at 1:23
  • I mean if the the only administrator account was locked.. Apr 29, 2015 at 1:37
  • Then they wouldn't be able to take ownership of the folder this my able to access the user's profile directory
    – Ramhound
    Apr 29, 2015 at 1:46

1 Answer 1

3

Yes. If you have administrative rights to the computer, you can access other user's files. Windows does not encrypt user data by default. All you need to do is at the lock screen, hit Switch User and then log in with an account that has administrative privileges. Or if the computer is a member of a domain, you can access them over the network by going to \\PC-NAME\C$ where PC-NAME is the name of the computer.

Note that this is not a security violation in any way. You must already have an account with administrator rights on the computer in question. If you do not, then there is no way to access the user's data through Windows. You'd have to extract the user's hard drive to get at them.

As you said "break into the user's account" in your question, I am giving you the benefit of the doubt that you're doing something ethical. But if you really mean to break into a computer that isn't yours to take files that don't belong to you, then this is not a hack site and you will not get assistance here.

I would advise you to reword your question.

5
  • I'm guessing when you mean extract the user's hard drive to get the files, it would not be in the same form as one will be able to see it from say e.g. Windows Explorer would it? Don't see the purpose of locking a user account if it can be extracted easily from a hdd. Apr 29, 2015 at 1:21
  • This type of attack that is described is no different then having access to root or su on OS X or Linux
    – Ramhound
    Apr 29, 2015 at 1:24
  • I mean that if you extract the hard drive and attach it to another computer, it will show up as drive D: or whatever, and you would be able to access files off it just like it were your own hard drive. There is an old saying in the computer industry... "If you have physical access to the machine, then you don't have security". Of course you could always use some kind of encryption software if you're concerned about data theft. THAT would prevent you from taking the data even if you did extract the hard drive.
    – Wes Sayeed
    Apr 29, 2015 at 1:26
  • But the hard drive itself would contain the locked admin user account, so im not sure how that would work. Apr 29, 2015 at 1:32
  • You'd just double-click the user's profile like you would any other folder. Windows would not stop you. If you have admin rights (on the host computer), you can bypass security on files -- even if you didn't have admin rights on the other computer. The host has no way of verifying that, and admin privileges always win, so access is granted.
    – Wes Sayeed
    Apr 29, 2015 at 1:38

Not the answer you're looking for? Browse other questions tagged .