Forgot the
Administrator's Password? - Reset Domain Admin Password in Windows
Server 2003 AD.
Featured Product:
Windows XP/2000/NT Key - Easy to use utility to reset
Windows 2003/XP/2K/NT local and domain controller administrator
passwords. Download FREE version
now! |
Note: In
order to successfully use this trick you must first use one of the
password resetting tools available on the Forgot
the Administrator's Password? page.
The reason for
that is that you need to have the local administrator's password in
order to perform the following tip, and if you don't have it, then the
only method of resetting it is by using the above tool.
Read more about
that on the Forgot
the Administrator's Password? page.
Update: You can also
discuss these topics on the dedicated Forgot Admin Password - Related Discussions
forum.
Lamer
note: This procedure is NOT designed for Windows XP since Windows XP
is NOT a domain controller. Also, for a Windows 2000 version of this
article you should read the Forgot
the Administrator's Password? - Change Domain Admin Password in Windows
2000 AD page.
Reader Sebastien
Francois added his own personal note regarding the changing of Domain
Admin passwords on Windows Server 2003 Active Directory domains (HERE ). I will quote parts of it (thanks Seb!):
Requirements
-
Local access
to the Domain Controller (DC).
-
The Local
Administrator password.
-
Two tools
provided by Microsoft in their Resource Kit: SRVANY and INSTSRV.
Download them from HERE
(24kb).
Step 1
Restart Windows
2003 in Directory Service Restore Mode.
Note: At
startup, press F8 and choose Directory Service Restore Mode. It disables
Active Directory.
When the login screen appears, log on as Local
Administrator. You now have full access to the computer resources, but
you cannot make any changes to Active Directory.
![]()
Step 2
You are now
going to install SRVANY. This utility can virtually run any programs as
a service. The interesting point is that the program will have SYSTEM
privileges (LSA) (as it inherits the SRVANY security descriptor), i.e.
it will have full access on the system. That is more than enough to
reset a Domain Admin password. You will configure SRVANY to start the
command prompt (which will run the 'net user' command).
Copy SRVANY and
INSTSRV to a temporary folder, mine is called D:\temp. Copy cmd.exe to
this folder too (cmd.exe is the command prompt, usually located at
%WINDIR%\System32).
Start a command
prompt, point to d:\temp (or whatever you call it), and type:
instsrv PassRecovery "d:\temp\srvany.exe"
(change the path
to suit your own).
It is now time
to configure SRVANY.
Start Regedit,
and navigate to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PassRecovery
Create a new
subkey called Parameters and add two new values:
name: Application
type: REG_SZ (string)
value: d:\temp\cmd.exe
name: AppParameters
type: REG_SZ (string)
value: /k net user administrator 123456 /domain
Replace
123456 with the password you want. Keep in my mind that the default
domain policy require complex passwords (including digits, respecting a
minimal length etc) so unless you've changed the default domain policy
use a complex password such as [EMAIL PROTECTED]
Now open the
Services applet (Control Panel\Administrative Tools\Services) and open
the PassRecovery property tab. Check the starting mode is set to
Automatic.
![]()
Go to the Log On
tab and enable the option Allow service to interact with the
desktop.
Restart Windows
normally, SRVANY will run the NET USER command and reset the domain
admin password.
Step 3
Log on with the
Administrator's account and the password you've set in step
#2.
Use this command
prompt to uninstall SRVANY (do not forget to do it!) by
typing:
net stop PassRecovery
sc delete PassRecovery
Now delete
d:\temp and change the admin password if you fancy.
Done!
Supplement
Robert Strom has written a
cool script that will completely automate this process. He
wrote:
"My script is really just
an automation of his process which performs all the post cleanup of
itself. Launch one script and it's all done. No manual registry entries,
the service is created, the service settings are all imported into the
registry, etc."
Download it from HERE
(186kb).
Note that you still need
physical access to the DC and the ability to log on locally as the local
administrator. If you do not have the local administrator's password use
the following tip: Forgot
the Administrator's Password?.
Thanks Robert!
Acknowledgments
This tip was compiled and
written with the help of Antid0t, Robert Strom and Sebastien Francois.
Thank you all!
Links
How to reset the Domain Admin Password under Windows 2003
Server![]()
Original post by Antid0t and Robert Strom on the MCSEworld
forums![]()
Related articles
You may find these related
articles of interest to you:
New:
|