Now and then many of you find yourselves in the unfavorable position of having to retrieve an NT system's lost Administrator account password. I can't even count the number of "help me!" messages I've received in this regard.
As I tell those of you who email me for help in this situation, there a couple of different approaches you can take, depending on your exact position. In any event you have two basic choices when recovering an Administrator password: you must either crack it or forcefully reset it to something known. It seems obvious to me that resetting the password will take much less time that brute force cracking, so it's a more cost affective way to handle the situation.
If you do want to brute force the password to see what it was set to, then you must obtain a copy of the system's SAM database and use a tool such as L0phtcrack to brute force crack the password. To get a copy of the SAM database, use NTFSDOS or a Linux boot disk with NTFS drivers on it. Either of those tool will allow you to boot a system from floppy and then read the installed NTFS partitions. You can find NTFSDOS at Winternals (http://www.winternals.com,) while Linux boot disks are available at various sites such as Ken Pfiel's NT Toolbox Web site (http://www.nttoolbox.com). . . .
)
)
Register
The Linux boot disk worked great....until today I was all pro microsoft but when I saw with my own eyes what that disk was able to do in a matter of seconds I became a beliver!!!<br>
James R. Overton June 11, 2001