23

I have an old ThinkPad R40 family laptop running Windows XP lying around and there's an account on it that has a password and it gave me a hint and I put everything I could possibly think in there and no luck. Is there any way to bypass the password?

Improve this question
5
  • 10
    You can always stick a Linux USB boot drive, and load it from BIOS. This is my usual method (getting into old Windows research computers). Simply Google "log into locked windows computer with linux usb". I can verify it works on Windows XP and Windows 7.
    – Shinobii
    Apr 15, 2019 at 14:26
  • 3
    Yeah, pretty sure every linux user ever has at some point recovered data from a windows box for a family/friend who got a virus or suffered some unrecoverable BSOD. Use a live USB/CD to pull the data off.
    – Jared Smith
    Apr 15, 2019 at 15:29
  • 2
    Duplicate of: superuser.com/questions/5039/…
    – Technoguyfication
    Apr 15, 2019 at 23:00
  • 3
    When you say "there's an account on it that has a password" does that mean there is (at least one) other account that you can get into, or is this the only account you know of?
    – TripeHound
    Apr 16, 2019 at 7:49
  • What do you need access to the account for? If you just want to grab the files, you can do so without logging in as long as they're not encrypted.
    – Cubic
    Apr 16, 2019 at 14:58

3 Answers 3

Reset to default
34

You can boot in safe mode an then try to reset the password.

  • Once you enter in safe mode you can go to Control Panel > User Account > Change Account.

  • Or in a command line window and type the

    net user [account name] [new password]

    e.g: 

    net user administrator password

If that's not possible, you can use a Linux live CD and boot with it. Mount the windows drive and use the chntpw to change the password. 

sudo chntpw -u "USER NAME" SAM
Improve this answer
7
  • 5
    Out of curiosity: Could you explain how this solves the problem? As far as I remember, Windows XP still required valid logon credentials even in safe mode. Is my memory wrong?
    – Heinzi
    Apr 16, 2019 at 7:31
  • 1
    @Heinzi You're right that you don't/shouldn't need safe mode if there is another account available. I was mainly focused on that the OP seemed to indicate (possibly just by loose wording) that there was another account available.
    – TripeHound
    Apr 16, 2019 at 8:24
  • 4
    In windows XP by default the administrator account has a blank password. Booting in safe mode with the user administrator can allow you to reset all other users passwords. You just need to choose the option administrator or write administrator in the logon box without password.
    – Hugo
    Apr 16, 2019 at 8:39
  • 7
    @Hugo: And why do you need safe mode for that? I.e., what prevents you from logging in as Administrator in "regular" mode?
    – Heinzi
    Apr 16, 2019 at 9:27
  • 2
    Because I do not remember if you could access it directly from the logon screen pressing control alt delete or not. on the other side I am sure you can do it using the safe mode. I did not wish to provide misleading information.
    – Hugo
    Apr 16, 2019 at 16:44
12

Change or empty the password located in %SystemRoot%\system32\config\SAM using external tools like the Offline Windows Password & Registry Editor bootdisk.

As this is Windows XP (EOL since April 2014), a better approach would be to backup the files e.g. with a SATA to USB adapter and then nuke the system. Password for the OS user doesn't protect the files.

Improve this answer
5
  • Is there a similar tool for Win10?
    – Thomas Weller
    Apr 15, 2019 at 18:20
  • Password for the OS user does protect the encrypted files, though. So if you have anything encrypted on the drive, there's no way to recover it without knowing the password. In some cases, it's easy enough to crack the password, though.
    – Luaan
    Apr 16, 2019 at 10:37
  • It's Windows XP and ThinkPad R40 was manufactured approximately in 2003: it doesn't have TPM. If OP is this far, the drive is not encrypted (or he has the encryption key). Also, it's not impossible to steal the encryption key if TPM has revealed it. You should always shutdown (or hibernate, but NOT sleep) the computer and have a power-on password.
    – Esa Jokinen
    Apr 16, 2019 at 12:50
  • A naive question - how do you backup the files if you cannot login to the computer?
    – user1993
    Apr 17, 2019 at 0:27
  • 2
    @user1993 pull the hard drive out and plug it into another computer
    – Petah
    Apr 17, 2019 at 3:55
5

Try the first answer by Hugo first (most XP machines weren't set up properly so that usually works)- if it doesn't work here's another option

Iv'e done this a lot by using the sethc file to bring up the command prompt before login

It works by replacing the sethc.exe (sticky keys) file in c:/windows/system32 with the command prompt (cmd.exe)

There are a few ways to do it - the most simple one is this, if you don't have a repair disk google "sethc hack windows 7" for other ways like booting into linux, this works with every version of windows (except windows 10 when it has been linked to your email account, otherwise it usually ok with windows 10 too)

Once the sethc.exe file is replaced with the cmd.exe file (however you did it) simply boot windows as normal, when you reach the login screen keep pressing the shift key until the command prompt appears. Type net user [username] [new password] and hit enter, you can now login with the new password

Improve this answer
5
  • 5
    @schroeder When accessibility tools are launched from the login/lock screen, they run under the (very) privileged SYSTEM user. You effectively end up with a root-level cmd, which can then trivially set user passwords. It is a bit of a hack, true, but not really a vuln worth fixing (in the sense of "they needed local/offline filesystem access to do this, so you're pwned anyway). Personally, I favour replacing Narrator, so it's still possible to get to the on-screen keyboard. (I'm guessing you know this; just elaborating for future readers. Feel free to copy this into the answer, Matt.)
    – Bob
    Apr 16, 2019 at 3:34
  • 1
    @Bob This is obviously not a vulnerability, since if you can replace files in system32, you are already on the other side of the airtight hatchway
    – kinokijuf
    Apr 16, 2019 at 7:46
  • @kinokijuf It doesn't require you to replace files in system32. Just use accessibility on the login screen, and you can launch task manager/cmd as administrator. It's a well known vulnerability on XP, it's actually been used for bypassing copy protection too :)
    – Luaan
    Apr 16, 2019 at 10:38
  • @Luaan [citation needed]? On a normal windows installation, you can only launch a pre-defined set of accessibility programs as SYSTEM from the login screen, and i assume they have been thoroughly checked for vulnerabilities.
    – kinokijuf
    Apr 16, 2019 at 16:34
  • @Bob I've found that which acceptability tool is least useful depends on the user, I picked the sticky keys one as its the most unused and there is lots of info on google if the user can't work out what I am saying (it gives a good starting point for a search), I didn't call it a hack I only used the word as (a search phrase) it gets the most results from google when using this. Its just another option if the OP cant get a result from the others that's all. We don't know the users skill level here so I gave an answer where people can easily use it to search for more help if they need it
    – Matt
    Apr 16, 2019 at 22:20

Not the answer you're looking for? Browse other questions tagged .