Wait! On Thu, May 1, 2008 at 12:13 PM, Andy Shook <[EMAIL PROTECTED]> wrote:
> For those of you playing along at home, I got this fixed. Nothing too > glamorous though, I just (finally) hacked the local admin password. Yanked > it out of the domain, rebooted, added back to domain, rebooted and I now > feel pretty again. > > > > Now back to listening to White Lion's greatest hits! > > > > Shook > ------------------------------ > > *From:* Ziots, Edward [mailto:[EMAIL PROTECTED] > *Sent:* Tuesday, April 29, 2008 3:50 PM > *To:* NT System Admin Issues > *Subject:* RE: remote reset of local admin password > > > > Shook the XP box you got the CPU account a Virtual Image. Go into Virtual > Control center and power it off. > > > > Then build a XP box, and add a drive, and point it to the VMDK if the > virtual XP box that got wacked. It should boot with that drive as a slave, > and then you can pull off the .SAM file load it into OPHCrack and do a brute > force. > > > > Z > > > > Edward E. Ziots > > Network Engineer > > Lifespan Organization > > MCSE,MCSA,MCP,Security+,Network+,CCA > > Phone: 401-639-3505 > > -----Original Message----- > *From:* Andy Shook [mailto:[EMAIL PROTECTED] > *Sent:* Tuesday, April 29, 2008 3:19 PM > *To:* NT System Admin Issues > *Subject:* RE: remote reset of local admin password > > > > Tried to access XP box in question over the network and get continued > access denied b\c it can't authenticate. > > > > Shook > ------------------------------ > > *From:* Ziots, Edward [mailto:[EMAIL PROTECTED] > *Sent:* Tuesday, April 29, 2008 3:12 PM > *To:* NT System Admin Issues > *Subject:* RE: remote reset of local admin password > > > > Can you attach the Image to another VM as a Disk drive, and Delete the SAM > from the XP workstation, and see if it allows you to login when the new SAM > is created? > > > > (Either that or you might be able to create another VM with a blank > password copy its .SAM file over the other one. Either that or get the .SAM > file and run that bugger through OPHCRACK with a brute-force to get the > password. > > > > Throws shovel to you to smash junior Admin in head. > > > > Z > > > > Edward E. Ziots > > Network Engineer > > Lifespan Organization > > MCSE,MCSA,MCP,Security+,Network+,CCA > > Phone: 401-639-3505 > > -----Original Message----- > *From:* Andy Shook [mailto:[EMAIL PROTECTED] > *Sent:* Tuesday, April 29, 2008 1:50 PM > *To:* NT System Admin Issues > *Subject:* remote reset of local admin password > > > > > > > > Scenario… > > > > Virtual XP Pro box on my ESX 3.5 cluster has had computer account deleted > by a junior admin, whose arse I have already kicked. No problem, pull it > our of the domain and re add, right. Yeah, well the local administrator > password is not listed in my documentation. (My fault; did not do it at > time of P2V b\c this dude was getting fired and I was in pucker mode trying > to lock out a high end developer out of everything rather quickly…/end rant) > > > > Soooo..I can't log in. Ok, boot machine to my ultimate boot cd and local > admin password reset utility. But, utility can't find the SAM b\c it can't > read the vmware virtual scsi drive. OK, mount the floppy image with the > VMWare XP Pro driver for the scsi disk. No go; utilty is looking for a > specific directory (/floppy/scsi). Tried creating /scsi directory on floppy > image and coping driver into same, no go. > > > > Been piddling with this for a while and I can't get the driver loaded. > Any pointers/ideas before I throw my mouse into the wall? > > > > TIA, > > > > > > Shook > > > > > > > > > > > > > > > > > > > > > ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
