0

I have an HP Pavilion 570 Desktop PC running Windows 10 with a UEFI BIOS and GPT partition. The computer is part of a domain.

History: We had our AD directory box keel over, so we had to replace it. I now get a trust issue on the computer, when attempting to log in. The solution is to log into the box, remove from the domain, delete the computer from the Active Directory Users and Computers, add back to the domain, and then test the login.

The key is to be able to log into a local administrator account account (not necessarily Administrator, but one with Administrator rights) and then perform the domain to workstation to domain tasks.

The problem is that I cannot log into the workstation using any domain user account (trust domain issue). That is normal for Microsoft. That is not a problem, but that the built-in Administrator account is disabled is the problem.

I have a license for Renee PassNow Pro, which is an awesome utility. You create a USB disk or a CD (I chose USB), and then you boot off of it. The app allows you to clear the password for any account and enable any account. The software works major awesomeness with any BIOS/MBR system (older computers), not so great with UEFI/GPT systems.

Their support team and product states

  1. Disable secure boot (should have added enable legacy boot)
  2. Enable Launch CSM (CSM: Compatibility Support Module for UEFI firmware)

Yeah, there is no such thing as CSM anything anywhere in the BIOS boot menu or the UEFI BIOS area, nothing / nada /zilch.

I can boot off of my USB stick (half the battle), but I do not see the Windows disk (the current problem).

I could care less about PassNow Pro. I am not wedded to it, so my question is not related to them. My question is now to solve the problem. I need to enable the built-in Administrator account and then reset the password. I am open to another utility, a Mark Russinovich (he is the guru at Microsoft who started sysinternals and founded the concept of a ponytail for real driver geeks), or an incantation (think Once Upon a Time or Harry Potter), whatever works. I do not have a wand, so...

How do I enable / reset passwords for built-in accounts on UEFI/GPT systems?

Thoughts?

UPDATE:

The recommended equivalent post, admin, was a nice try. I tried it. Sadly, step 7 after entering REM_SAM, resulted in a permission denied file is in use error. That took care of that. I was not able to get into safe mode, so that took care of the second answer.

Improve this question
7
  • Does this answer your question? How to get rights of admin after I disabled all admin accounts in my computer – Ramhound Mar 28 '20 at 18:31
  • If you can boot into your PC as local admin, all it takes to enable the built-in Administrator account is this command (as admin) : netuser Administrator /active:yes (if your PC is in English; you can use a lowercase a for "administrator" too). That's IF you can boot into a local admin account... EDIT: once done, log off your regular account, choose "Other", then "Administrator" (no password needed unless specified by your sysadmin, in which case, well...) – user1019780 Mar 28 '20 at 18:40
  • EDIT to my timed-out first comment: since you're locked out of your own PC, you can try the same command I suggested from a command line in Windows PE, and boot from it at logon screen. And it's "net user", not "netuser" as I typed in my first comment. My apologies. – user1019780 Mar 28 '20 at 18:55
  • @Didier I booted off the Win10 DVD and went to a command prompt. Of course the command worked there, but that was to the DVD's Win10 (C:) not the real one (X:). That is why other answers use a registry editor loading the X:\...\SAM, so no go. I am trying the Linux thing now. It is annoying that a simple task is becoming a project. – Sarah Weinberger Mar 28 '20 at 22:01
  • Note: I thought that I had it when I went to UEFI and cleared the secure boot keys, saved, and restarted the system. I then went to a Win10 command prompt and still could not load the hive. – Sarah Weinberger Mar 28 '20 at 23:06
0

How do I enable / reset passwords for built-in accounts on UEFI/GPT systems?

  1. Boot any UEFI-compatible Linux system.
  2. Install the "ntfs-3g" and "chntpw" packages.
  3. Mount the Windows volume using ntfs-3g.
  4. Use chntpw to unlock accounts and/or zero out passwords. (Wouldn't recommend using it to promote non-admin users though.)

chntpw is the same tool as found in the popular ntpasswd "Offline NT Password and Registry Editor".

Improve this answer
5
  • Nope. When issuing ntfs-3g /dev/sda1 /mnt/windows, I receive Error opening /dev/sda1 permission denied. This error message is the same error message than I received from using regedit and that Win10 tool. All roads lead to "permission denied". In one case the error also adds file in use. Either the drive is in use or possibly UEFI is read only. Either way, I am still locked out. As a side note, I used Linux Mint. It is such a nice looking UI. It comes preloaded with ntfs-3g. It is so much nicer than CentOS. – Sarah Weinberger Mar 28 '20 at 22:18
  • The message might be similar, but it comes from a completely different source. To access disk nodes under /dev (as well as to mount filesystems), you need root privileges on the running Linux system – nothing to do with the OS installed on that disk. – user1686 Mar 28 '20 at 22:25
  • Thanks! I was an idiot. I forgot the sudo su command prior to that. That being said, the error is now something like: the file system contains unsafe data. The Windows Metadata contained in cache refused to mount. (so much for my memorization skills) It would appear that I need to do a chkdsk from the command prompt, if that is even possible. – Sarah Weinberger Mar 28 '20 at 22:37
  • I went to a command prompt (Win10 DVD) and issued chkdsk X: /F and received: Windows cannot run disk checking on this volume because it is write protected. That means all roads lead to the same problem, namely that the UEFI BIOS is write protecting the disk somehow and I need to remove that, not that that is obvious on the how. – Sarah Weinberger Mar 28 '20 at 22:52
  • Clearing the secure boot keys and then issuing the ntfs-3g /dev/sda1 /mnt/windows worked, no errors. Wow! So now I am off to step 4. NOTE: I was able to mount /dev/sda4 (the real drive, not sda1) and use chntpw clear the password (1) and enable the account (2) & use hex editor for 0x38 from 11 to 10; verified on reboot to Mint, but sadly when I attempt to log into Windows I get account disabled for Administrator; quite annoying. – Sarah Weinberger Mar 29 '20 at 0:22
0

I found a tool long ago. Some call it a rescue CD. It boots and handles UEFI and GPT. It also includes the Offline NT Password and Registry Editor mentioned above. It also includes many other neat utilities. Offline NT Password and Registry Editor".

https://toolslib.net/downloads/viewdownload/255-winpese-x64/

Improve this answer
1
  • The GUI is a full fledged Winows, looks cool, and sadly uses the same methodology as the answer in the link, namely opening "X:\Windows\System32\Config\SAM". Like my experience with RegEdit, NTPWedit says open failed, which translates to permission denied, file in use. Sorry, but this answer did not work. – Sarah Weinberger Mar 28 '20 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.