Recovering W10 password - Xpost

There is an known well exercised security hole involving renaming cmd.exe the same name as a file used for an accessibility support feature...

Use a bootable USB stick with Peter Nordahl's tool, it can't tell you what the password is, but it can change it ...

Assuming you have not got some form of drive encryption enabled, and you don't need to load special drivers (e.g. for a RAID controller) to access your hard drive, there are a couple of ways to do this.

Warnings:

Note that resetting an account password will likely lose any saved passwords in internet explorer. It may also may any encrypted files created in the account unrecoverable.

Steps:

That will drop you into a restricted command prompt, probably at an X:\ prompt. Change drive to the boot disk (probably c:\ but might not be while in the recovery console)

cd \windows\system32 ren utilman.exe utilman.bak copy cmd.exe utilman.exe exit

Restart machine normally, and at the login screen click the accessibility icon. That will now open a command prompt with admin privilege

type:

net user name_of_your_account new_password exit

You can now login using the new password.

To fully undo this hack, you need to either: go back to step 1 again, and use the same trick to replace the overwritten file from the backup:

cd \windows\system32 del utilman.exe ren utilman.bak utilman.exe exit

OR

replace the files in windows but you will need to manipulate the NTFS permissions and file ownership to give you the privilege to make the changes to files in a system folder since these files are usually owned by "TrustedInstaller" and even local admins don't have privilege to change them by default.

Thanks to all who responded.

The recovery settings finally worked and I have access.

However I will pass the information on to a friend who has a similar problem but without recovery numbers set up.

Cheers

Dave R