Recovering W10 password - Xpost

[David]

Early days, but I need to get into a W10 system and the apparent password on a bit of paper under the keyboard doesn't work.

I am trying to use the "recover password" option on the front screen which gives me the option of an email address (which isn't much good if the PC is locked) or a phone number.

I've tried this option (landline number has the same last two digits) but I keep getting "problem with the service, please try again later" ONO.

Firstly has anyone successfully used this password recovery method?

Secondly, if not is there a way/set of tools to crack the W10 password?

This is an all-in-1 system and I haven't yet tried to boot it from external media.

Connected to the LAN via a WiFi dongle so it could be that the system can't connect over WiFi until logged in. I can take it to the router and connect over Ethernet if necessary.

TIA

Dave R

[Adrian Caspersz]

There is an known well exercised security hole involving renaming cmd.exe the same name as a file used for an accessibility support feature...

[Andy Burns]

Use a bootable USB stick with Peter Nordahl's tool, it can't tell you what the password is, but it can change it ...

[John Rumm]

Assuming you have not got some form of drive encryption enabled, and you don't need to load special drivers (e.g. for a RAID controller) to access your hard drive, there are a couple of ways to do this.

Warnings:

Note that resetting an account password will likely lose any saved passwords in internet explorer. It may also may any encrypted files created in the account unrecoverable.

Steps:

1) Boot machine from windows media (CD/USB etc) 2) At the Windows Setup screen, set your region etc, and click Next 3) From the install screen, click "Repair your computer" 4) Choose Troublshoot from the next screen 5) Then Advanced options 6) Then command prompt

That will drop you into a restricted command prompt, probably at an X:\ prompt. Change drive to the boot disk (probably c:\ but might not be while in the recovery console)

cd \windows\system32 ren utilman.exe utilman.bak copy cmd.exe utilman.exe exit

Restart machine normally, and at the login screen click the accessibility icon. That will now open a command prompt with admin privilege

type:

net user name_of_your_account new_password exit

You can now login using the new password.

To fully undo this hack, you need to either: go back to step 1 again, and use the same trick to replace the overwritten file from the backup:

cd \windows\system32 del utilman.exe ren utilman.bak utilman.exe exit

OR

replace the files in windows but you will need to manipulate the NTFS permissions and file ownership to give you the privilege to make the changes to files in a system folder since these files are usually owned by "TrustedInstaller" and even local admins don't have privilege to change them by default.

[David]

Thanks to all who responded.

The recovery settings finally worked and I have access.

However I will pass the information on to a friend who has a similar problem but without recovery numbers set up.

Cheers

Dave R