23

I have an old ThinkPad R40 family laptop running Windows XP lying around and there's an account on it that has a password and it gave me a hint and I put everything I could possibly think in there and no luck. Is there any way to bypass the password?

closed as off-topic by Xander, kalina, Stephane, vidarlo, multithr3at3d May 6 at 1:02

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, kalina, Stephane, vidarlo, multithr3at3d
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 10
    You can always stick a Linux USB boot drive, and load it from BIOS. This is my usual method (getting into old Windows research computers). Simply Google "log into locked windows computer with linux usb". I can verify it works on Windows XP and Windows 7. – Shinobii Apr 15 at 14:26
  • 3
    Yeah, pretty sure every linux user ever has at some point recovered data from a windows box for a family/friend who got a virus or suffered some unrecoverable BSOD. Use a live USB/CD to pull the data off. – Jared Smith Apr 15 at 15:29
  • 2
    Duplicate of: superuser.com/questions/5039/… – Technoguyfication Apr 15 at 23:00
  • 3
    When you say "there's an account on it that has a password" does that mean there is (at least one) other account that you can get into, or is this the only account you know of? – TripeHound Apr 16 at 7:49
  • What do you need access to the account for? If you just want to grab the files, you can do so without logging in as long as they're not encrypted. – Cubic Apr 16 at 14:58
34

You can boot in safe mode an then try to reset the password.

  • Once you enter in safe mode you can go to Control Panel > User Account > Change Account.

  • Or in a command line window and type the

    net user [account name] [new password]
    

    e.g:

    net user administrator password
    

If that's not possible, you can use a Linux live CD and boot with it. Mount the windows drive and use the chntpw to change the password.

sudo chntpw -u "USER NAME" SAM
  • 5
    Out of curiosity: Could you explain how this solves the problem? As far as I remember, Windows XP still required valid logon credentials even in safe mode. Is my memory wrong? – Heinzi Apr 16 at 7:31
  • 1
    @Heinzi You're right that you don't/shouldn't need safe mode if there is another account available. I was mainly focused on that the OP seemed to indicate (possibly just by loose wording) that there was another account available. – TripeHound Apr 16 at 8:24
  • 4
    In windows XP by default the administrator account has a blank password. Booting in safe mode with the user administrator can allow you to reset all other users passwords. You just need to choose the option administrator or write administrator in the logon box without password. – Hugo Apr 16 at 8:39
  • 7
    @Hugo: And why do you need safe mode for that? I.e., what prevents you from logging in as Administrator in "regular" mode? – Heinzi Apr 16 at 9:27
  • 2
    Because I do not remember if you could access it directly from the logon screen pressing control alt delete or not. on the other side I am sure you can do it using the safe mode. I did not wish to provide misleading information. – Hugo Apr 16 at 16:44
13

Change or empty the password located in %SystemRoot%\system32\config\SAM using external tools like the Offline Windows Password & Registry Editor bootdisk.

As this is Windows XP (EOL since April 2014), a better approach would be to backup the files e.g. with a SATA to USB adapter and then nuke the system. Password for the OS user doesn't protect the files.

  • Is there a similar tool for Win10? – Thomas Weller Apr 15 at 18:20
  • Password for the OS user does protect the encrypted files, though. So if you have anything encrypted on the drive, there's no way to recover it without knowing the password. In some cases, it's easy enough to crack the password, though. – Luaan Apr 16 at 10:37
  • It's Windows XP and ThinkPad R40 was manufactured approximately in 2003: it doesn't have TPM. If OP is this far, the drive is not encrypted (or he has the encryption key). Also, it's not impossible to steal the encryption key if TPM has revealed it. You should always shutdown (or hibernate, but NOT sleep) the computer and have a power-on password. – Esa Jokinen Apr 16 at 12:50
  • A naive question - how do you backup the files if you cannot login to the computer? – user1993 Apr 17 at 0:27
  • 2
    @user1993 pull the hard drive out and plug it into another computer – Petah Apr 17 at 3:55
5

Try the first answer by Hugo first (most XP machines weren't set up properly so that usually works)- if it doesn't work here's another option

Iv'e done this a lot by using the sethc file to bring up the command prompt before login

It works by replacing the sethc.exe (sticky keys) file in c:/windows/system32 with the command prompt (cmd.exe)

There are a few ways to do it - the most simple one is this, if you don't have a repair disk google "sethc hack windows 7" for other ways like booting into linux, this works with every version of windows (except windows 10 when it has been linked to your email account, otherwise it usually ok with windows 10 too)

Once the sethc.exe file is replaced with the cmd.exe file (however you did it) simply boot windows as normal, when you reach the login screen keep pressing the shift key until the command prompt appears. Type net user [username] [new password] and hit enter, you can now login with the new password

  • 5
    @schroeder When accessibility tools are launched from the login/lock screen, they run under the (very) privileged SYSTEM user. You effectively end up with a root-level cmd, which can then trivially set user passwords. It is a bit of a hack, true, but not really a vuln worth fixing (in the sense of "they needed local/offline filesystem access to do this, so you're pwned anyway). Personally, I favour replacing Narrator, so it's still possible to get to the on-screen keyboard. (I'm guessing you know this; just elaborating for future readers. Feel free to copy this into the answer, Matt.) – Bob Apr 16 at 3:34
  • 1
    @Bob This is obviously not a vulnerability, since if you can replace files in system32, you are already on the other side of the airtight hatchway – kinokijuf Apr 16 at 7:46
  • @kinokijuf It doesn't require you to replace files in system32. Just use accessibility on the login screen, and you can launch task manager/cmd as administrator. It's a well known vulnerability on XP, it's actually been used for bypassing copy protection too :) – Luaan Apr 16 at 10:38
  • @Luaan [citation needed]? On a normal windows installation, you can only launch a pre-defined set of accessibility programs as SYSTEM from the login screen, and i assume they have been thoroughly checked for vulnerabilities. – kinokijuf Apr 16 at 16:34
  • @Bob I've found that which acceptability tool is least useful depends on the user, I picked the sticky keys one as its the most unused and there is lots of info on google if the user can't work out what I am saying (it gives a good starting point for a search), I didn't call it a hack I only used the word as (a search phrase) it gets the most results from google when using this. Its just another option if the OP cant get a result from the others that's all. We don't know the users skill level here so I gave an answer where people can easily use it to search for more help if they need it – Matt Apr 16 at 22:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.