Question
How do I change my Windows password from recovery mode?
Environment
Windows VMs
All OnApp Versions
Answer
The following commands are to be run on the VM:
1. Reboot the VM in recovery mode
2. Get access to the Windows VM disk with the following command:
kpartx -a -p X /dev/sdb
3. Check if the disk exists:
fdisk -l /dev/mapper/sdbX1
4. Mount the disk with the following command:
mount -t ntfs-3g /dev/mapper/sdbX1 /mnt/
5. Run the following commands:
mv /mnt/Windows/System32/Utilman.exe /mnt/Windows/System32/Utilman.exe.bak
cp /mnt/Windows/System32/cmd.exe /mnt/Windows/System32/Utilman.exe
6. Unmount the disk:
umount /mnt/
7. Run the following command:
kpartx -d -p X /dev/sdb
8. Stop and then Start the VM via the OnApp UI
Once the VM starts up, log into the console and press Windows Key + U to get a Command Prompt.
9a. To reset the password of an existing user, type the text below. We are changing Administrator’s password to onapppass.
net user Administrator onapppass /active:yes
9b. Alternatively, if you want to create a new user with the username NewUser and password abc123 into the Administrator group.
net user NewUser abc123 /add
net localgroup Administrators NewGuy /add
10. Now you need to restore the original utilman.exe from the VM:
C:
cd windows\system32
del utilman.exe
ren Utilman.exe.bak Utilman.exe
Comments
3 comments
Hello,
I had follow this manual, I get stuck at step 3. My OS is Windows_2008_Enterprise_Edition_R2_CH_x64.
Is there anything wrong.
[root@recovery mnt]# kpartx -a -pX1 /dev/sdb1
failed to stat() /dev/sdb1
Andy
Hi Andy,
Can you do a fdisk -l whilst in recovery mode, perhaps the disk has picked up a different device to /dev/sdb1 which was used in the example?
As https://community.spiceworks.com/topic/2237084-utilman-exe-lost-password-recovery-method-no-longer-works , if there's Windows Defender , on After step 5 , you may need to rename
\mnt\ProgramData\Microsoft\Windows Defender
\mnt\Program Files\Windows Defender
\mnt\Program Files (x86)\Windows Defender
to something like
\mnt\ProgramData\Microsoft\Windows Defender_
\mnt\Program Files\Windows Defender_
\mnt\Program Files (x86)\Windows Defender_
This stops Windows Defender from stopping/blocking cmd.exe to be brought up on Step 8 .
After password reset or adding admin user via cmd , may boot in again in recovery mode to rename back the Windows Defender folders as above .
Rgds ,
Teh (Exabytes)
Please sign in to leave a comment.