Resetting a password in Windows 7 or Windows Vista

Resetting a password in Windows 7 or Windows Vista

One problem that comes up now and again for any OS (well, any modern OS) is how to recover administrative access to the system when the password has been forgotten.

There’s a reasonably straightforward solution [1] for Windows 7, which I haven’t seen on the web so far, so I thought I should publish it. Be aware that I can’t offer or provide any warranty, support, or assistance with this procedure, apart perhaps from clarifying any part of the instructions that aren’t clear. It’s always worked for me, but that’s all I can promise.

This procedure also works on Windows Vista; the underlying technique works on Windows XP as well but is not usually feasible because the Windows XP install CD does not contain a command-line recovery option.

One important caveat: since this resets the password rather than letting you find out what it is, any encrypted files belonging to the user will be permanently lost.

This is the short version, for advanced users and sysadmins:

1. Boot to Windows 7 from the installation DVD, or from Windows PE 3 boot media, or from a Windows 7 installation on another HDD. If the target OS is Vista, use the Vista installation DVD, or Windows PE 2, or another Vista installation. (Booting to a mismatched version of Windows might work, but I’ve never tried it; if the registry file formats aren’t exactly the same between versions, this could result in a corrupted registry and an unbootable system.)
2. Load the SYSTEM registry hive from the target OS. Back it up first.
3. In the Setup key, change SetupType to 2 and CmdLine to cmd.exe.
4. Boot the target OS. You’ll get a command-line window in system context.

The long version, for everyone else:

1. Boot to your Windows 7 or Windows Vista installation DVD, whichever matches the installed OS. If you purchased your computer from a responsible vendor, they’ll have provided you with one, although unfortunately many vendors don’t. A vendor system recovery disk might offer the same functionality, and in some cases you can order an installation DVD from your vendor (or from Microsoft?).
   Additional note 5 May 2011: Nommo was kind enough to point me to this post on Microsoft Answers which provides a link to downloadable repair disks for Vista and Windows 7. I can’t from my own knowledge confirm that these disks are legitimate, and Microsoft aren’t telling, so use only at your own risk. Indications are that they are probably OK. (Personally, I wouldn’t use the charged-download option until I’d checked how much my OEM was going to charge to provide an installation disk. Make sure the OEM knows you need a Windows installation disk, not a system recovery disk.)
2. Select your language options on the first screen and press Next to continue.
3. Choose “Repair Your Computer”.
4. Choose “Use recovery tools…” and select your OS. Make a note of which drive letter it is on, e.g., C: or D:. This might not be the same drive letter you see when booted normally.
5. Select Command Prompt.
6. In the command prompt window that appears, type “regedit” and press ENTER.
7. Select HKEY_LOCAL_MACHINE and then choose Load Hive from the File menu.
8. Find and open the file named SYSTEM on the drive you noted in step 4. If Windows is in the default configuration, this will be in windows\system32\config.
9. Enter a key name, e.g., “xxx”.
10. Click the plus icon to the left of HKEY_LOCAL_MACHINE to open this key.
11. Select Export from the File Menu. Change the Save as type to Registry Hive Files. Type a name for the backup, for example, systembackup, and press Save. (This step creates a backup of the unmodified SYSTEM registry hive as a precaution.)
12. Open the xxx key, and select Setup.
13. Double-click on SetupType in the right-hand pane. Enter 2 and press OK.
14. Double-click on CmdLine. Enter cmd.exe and press OK.
15. Close Registry Editor. Type “regedit” and press ENTER to open it again. (This step does not appear to be necessary in Windows 7, but in Windows Vista if you do not do this the next step might fail with an Access Denied error.)
16. Open HKEY_LOCAL_MACHINE, select xxx, and choose Unload Hive from the File Menu. Push Yes.
17. Close the command window and the Registry Editor. Remove the installation DVD and select Restart.
18. When your computer boots up, another command window should appear.
19. Type “net user foo bar”, replacing foo with the username of the account whose password you want to reset, and bar with the new password. For example, you might type “net user Administrator letmein”. Press ENTER.
20. If you want to use the built-in Administrator account, you will probably need to enable it: type “net user Administrator /active:yes” and press ENTER.
21. If you don’t know what the administrative username(s) are, type “net localgroup administrators” and press ENTER to find out.
22. Type “exit” and press ENTER.
23. When the logon screen appears, use the username and the new password to log in.

Note that if the entire disk is encrypted, this procedure will not work at all. System administrators who want to prevent users from using techniques like this one to reset passwords should consider disk encryption. [2] Another option is to configure the system BIOS to disallow booting from removable media, although if the user can open the case of the machine this can usually be reset.