How to Reset a Windows Password With Just Physical Access and an Ubuntu USB
For the majority of my career I’ve worked at small companies. It’s not uncommon that in addition to engineering I also have to play the role of IT specialist. In this role, there have been a few occurrences of being locked out of a Windows PC (often due to an employee leaving the company and have no IT offboarding process). Luckily, with just physical access and a USB key preloaded with Ubuntu, resetting the user password and gaining access to a PC isn’t all that difficult.
The overall process looks like this:
- Boot the PC into Ubuntu using the USB
- Access the Windows partition and change the user account settings using
- Reset the PC and boot into Windows with the new credentials
- Bootable USB flash drive loaded with Ubuntu
- Target PC
Boot into Ubuntu
Booting a PC from a USB is typically a quick process. Often, the hardest part is figuring out what key combination is required to change the boot media from the startup screen. Depending on the PC brand, the key that accesses the boot menu may be different:
- Lenovo PCs tend to use
- HP computers may require modifying the boot order in the BIOS first using
- Dell systems appear to use either
Regardless of the brand or system, there’s a good chance that you may have to reset the PC a couple times before getting the right key combination.
Once you successfully boot Ubuntu from the USB, select
Try Ubuntu without installing.
Changing Windows Account Settings from Ubuntu
Now that we’re loaded into Ubuntu, it’s time to modifying the Windows user account settings.
sudo add-apt-repository universe sudo add-apt-repository multiverse sudo apt update
sudo apt install chntpw
Navigate to the directory containing the Security Account Manager (SAM) database file in the Windows partition. Typically, the Windows partition is mounted under
/mediaas a long hexidecimal string. From this mount, we want to navigate to
cd /media/<WINDOWS MOUNT>/Windows/System32/config
sudo chntpw SAMto see a list of users and to change the admin password or use
sudo chntpw –u <username> SAMto change the password of a specific user. I personally recommend setting the password to
Clear (blank) user password.
Turn off the PC.
Remove the USB drive.
Boot back into Windows