Reset Forgotten Administrator password in Windows

This tutorial provides step-by-step instructions for resetting the users’ password in Windows from the command prompt without using any third party tool or password reset disk.

Advertisements
Using the Utilman.exe to get the command prompt without login

Windows has an inbuilt utility Utilman.exe for the disabled people. To assist the disabled people in login process, this utility is available on the login screen and does not require any authentication to access. It allows users to configure the accessibility options such as Magnifier, High contrast theme, Narrator and On Screen Keyboard. It can be run by either pressing the Window + U keys combination or by clicking the Ease of Access icon on the login screen.

easy of access icon

This utility can be used as the back door to run the other utility without login. For example to access the command prompt on the login screen, the utility cmd.exe can be disguised in this utility. The utility cmd.exe provides command prompt. From the command prompt, users’ passwords can be reset easily.

Let’s understand this process practically with example.

Disguising cmd.exe in Utilman.exe

Advertisements

Boot the system from the Windows installation disk (the disk which you used to install the Windows). Press Shift + F10 keys combination on the first screen of the installation wizard to access the command prompt.

Windows 10

windows 10 command prompt

Windows 8

windows 8 command prompt

Windows 7

windows 7 command prompt

Locating Windows partition

The file Utilman.exe is available in the directory Windows\System32 of the Windows partition. Windows partition is the partition which contains Windows installation files. If you know the Windows partition, skip this step. Otherwise to locate the Windows partition, run the following command.

X:\Sources> wmic logicaldisk get caption

This command scans attached hard disk and prints the drive letters of all partitions. To find the Windows partition from all listed partitions, use the command dir. The command dir lists the contents of the supplied source.

locate windows partition

Once the Windows partition is detected run the following commands.

DWP:\>move DWP:\Windows\System32\Utilman.exe  DWP:\Windows\System32\Utilman.exe.bak
DWP:\>copy DWP:\Windows\System32\cmd.exe DWP:\Windows\System32\Utilman.exe
DWP:\>wpeutil reboot
DWP = Drive letter of the Windows partition.

Let’s briefly understand what each command does.

  • First command renames the original file Utilman.exe to Utilman.exe.bak. By this command, we actually take the backup of original file at the same location. Later, we will use this backup copy to restore the original file back.
  • Second command makes the copy of cmd.exe with the new name Utilman.exe.
  • Third command reboots the system.

copy and move utilman.exe

To avoid running the installation wizard again, remove the installation disk before rebooting the system.

Accessing command prompt at login screen

Advertisements

Since Utilman.exe has been replaced with cmd.exe, clicking the Ease of Access icon at login screen will open the command prompt instead of the Ease of Access utility.

Windows 10

windows 10 command prompt

Windows 8

windows 8 command prompt at login screen

Windows 7

windows 7 command prompt at login screen

Changing user account’s password

To change a user account’s password, use the following command.

net user [username] *
Type a password for the user: [type new password]
Retype the password to confirm: [type new password again]

Replace the [username] with the name of user whose account password you want to change. For example to reset the built-in administrator account’s password, use the following command.

net user administrator *
Type a password for the user: [type new password]
Retype the password to confirm: [type new password again]

While typing the password at the command prompt, indicative asterisk [*] characters do not appear. It’s standard security feature which prevents users from guessing the length of the password.

changing built-in windows administrator account password

Let's take another example, change the password of a user whose username is lxsoftwin.

net user lxsoftwin *
Type a password for the user: [type new password]
Retype the password to confirm: [type new password again]

resetting user password

Activating built-in administrator account

Starting from Windows 8.1, built-in administrator account is disabled. If require, you can enable it with following command

net user administrator /active:yes
activating administrator password

Creating a local administrator account without password

If you only want to access the system for maintenance or troubleshooting purpose, you can create a new temporary user account and add it in administrator group. Once your task is finished, you can delete this temporary account.

To add a new administrator account, use the following commands: -

net user [user name] /add
net localgroup administrators [user name] /add
  • First command adds a new user account.
  • Second command makes this user account a member of the administrators group.

adding new administrator account

If require, you can also assign a password to this account. To assign a password, use the same command which we used to reset the user account’s password.

Added user will be listed in the user list immediately.

listing added user

Once the required changes have been done, close the command prompt window and close the system.

restart the system

Restoring the original file back

Boot the system from the installation disk and press the Shift + F10 keys combination at the first screen of the installation wizard. This will open the command prompt window again.

Run the following commands to the restore the original file back.

DWP:\> del DWP:\Windows\System32\utilman.exe
DWP:\> move DWP:\Windows\system32\utilman.exe.bak DWP:\Windows\System32\utilman.exe
DWP:\>wpeutil reboot
DWP = Drive letter of Windows partition.
  • First command deletes the modified file.
  • Second command restores the original file back.
  • Third command reboots the system.

restoring original file back

As we did earlier, remove the installation disc before rebooting the system.

We are done

After reboot, use your new password or account to login to the system.

tempadmin login

This way without harming any system file, we can easily reset Windows admin password, create a new local administrator account and change any local user’s account password from the command prompt on our own.

Third party tools

If you don’t have command line experience or just looking for a ready to use third party tool or software to reset the Windows admin password, you can try the following products.

PCUnlocker

PCUnlocker is a bootable disk that can find lost Windows and Office product key, bypass or reset forgotten passwords of local administrator and Microsoft account in Windows 10, 8, 7, Vista and XP.

TunesBro WinGeeker

This software provides the most elegant and the simplest solution for Windows password recovery at a nominal cost. It can reset any Windows password including Server version.

That’s all for this tutorial. If you like this tutorial, please don’t forget to share it through your favorite social network.

Advertisements

ComputerNetworkingNotes Windows Tutorials Reset Forgotten Administrator password in Windows