Recover administrator password in Windows

Although having different users in Windows installation is really good for security, specially if the users have no administrator capabilities, because they won’t be able to modify crucial files and render the system useless. This is a tipical recommendation in all operating systems: don’t use the administrator account as your regular account.

Sometimes, people not using the administrator account for a long time forget the password for that account and can’t login with administrator privileges to install software or update drivers. This is a big problem, which is usually resolved by formatting the disk and reinstalling Windows. By doing this you lose a lot of time and have the possibility of erasing important files if you are not careful enough or don’t have correct and update backups.

Luckily there are other options for recovering the administrator password. The one I like the most is the use of a recovery CD which allows to edit the password without modifying anything else, so you don’t need to risk losing data or settings in your programs.

I have used many times Offline NT Password & Registry Editor and it works like a charm, allowing me to change the administrator password without a problem. I’m going to explain how to do it.

In first place, download the CD image and burn it to a disk, which you will use to boot your computer. Once it has booted you will be presented with a menu like this:

=========================================================
. Step ONE: Select disk where the Windows installation is
=========================================================
Disks:
Disk /dev/ide/host0/bus0/target0/lun0/disc: 2147 MB, 2147483648 bytes
NT partitions found:
 1 :   /dev/ide/host0/bus0/target0/lun0/part1    2043MB  Boot
Please select partition by number or
a = show all partitions, d = automatically load new disk drivers
m = manually load new disk drivers
l = relist NTFS/FAT partitions, q = quit
Select: [1]

Here you have to select the hard disk drive where Windows is installed. In most cases, you will only have one disk so you can pick the default selection and it will work right away. It then asks to load drivers, but unless you have a very strange hardware use autoprobe (the letter d).

Once this has been done the system finishes booting and looks for where the password is stored in the harddisk. It should find only one place, so you can accept the default selection and it will show the menu asking which action you want to do:

Select which part of registry to load, use predefined choices
or list the files with space as delimiter
1 - Password reset [sam system security]
2 - RecoveryConsole parameters [software]
q - quit - return to previous
[1] :

In this case you want to reset the password so pick the default selection (number 1) and it will show another menu asking for an action:

Loaded hives: <sam> <system> <security>

What to do? [1] ->

You must also select the default option (number 1) and you will see a list of all the users in the system with their RID, a number which identifies each one:

===== chntpw Edit User Info & Passwords ====
RID: 01f4, Username: <Administrator>
Select: ! - quit, . - list users, 0x<RID> - User with RID (hex)
or simply enter the username to change: [Administrator]

If Administrator is the default option you can press Enter to select it and change its password or you can even make the password blank which, by the way, is the recommended option.

* = blank the password (This may work better than setting a new password!)
Enter nothing to leave it unchanged
Please enter new password: *

To do this press * key, confirm the change and press ! to go back to the main menu. When you are there tell the program you want to quit with the q key and it will ask if you want to save the changes, so say yes. Then all the changes will be written back to disk and when it finishes you can reboot the system into Windows (remember to take out the CD).

When Windows boots again, you can login into Administrator account without any password. It’s recommended that you assign a new password to it from the management console, and the process is finished.