How to reset the administrator password on a Windows server

Learn how to reset your Administrator account password with the Windows customer rescue system.

Requirements

Microsoft Windows installed on your dedicated server
At least 16 GB of RAM installed on the server
Access to the OVHcloud Control Panel

Warning

NOTE: This guide is not applicable to the legacy Windows rescue system (WinPE rescue mode); see our rescue mode guide for more information.

If your Windows Server version is out of support, you might no the able to activate the current rescue system for Windows. In this case, you can use an alternative method for resetting the administrator password using the OVHcloud customer rescue system based on Debian.

Topics

Resetting the admin password using the OVHcloud Windows Customer Rescue System
Resetting the admin password using OVHcloud rescue mode

Instructions

Resetting the admin password using the OVHcloud Windows Customer Rescue System

Step 1: Reboot the server into rescue mode
Step 2: Clear the current password
Step 3: Reboot the server

Step 1

Step 2

Step 3

Step 1: Reboot the server into rescue mode

The system has to be started in the Windows customer rescue system before the admin password can be changed.

For detailed instructions, please refer to the Windows rescue mode guide.

Step 2: Clear the current password

Connect to your server in Remote Desktop using the credentials provided by email.

Please note that the username for the rescue mode is Administrator.

If your server uses software RAID on your Windows disk, you have to import your Windows local disk to be able to access it: Follow the instructions in section A below.
If your server does not use software RAID on your Windows disk, you should be able to directly access the local Windows disk as explained in section B of this guide.

A - Importing your local Windows disk

Access disk management

Right-click the Start menu and select Disk Management.

Man customer rescue mode - step 4

You can then see the disks and volumes of the server.

Man customer rescue mode - step 2

Your server's Windows disk is probably Disk 1. You must import it to be able to access it.

Please note that if you have several disk groups, the number of the Windows disk may vary. You may have to import several disks to get the Windows one.

You also have to import the second disk to properly import your software RAID volume.

Import local disks

Right-click Disk 1 and select Online.

Man customer rescue mode

Do the same thing for the second disk (Disk 2) to properly import your software RAID volume.

Right-click Disk 2 and select Online.

Man customer rescue mode - step 3

Disks are now seen as "Dynamic" and "Foreign".

Right-click Disk 1 again and select Import Foreign Disks.

Man customer rescue mode - step 7

Click OK twice.

Man customer rescue mode - step 5

Man customer rescue mode - step 6

You can see that the local disk is now accessible and that the Windows disk is drive (E:) (spreading on two software RAID disks with Mirrored volume type).

Man customer rescue mode - step 8

Info

In this example, the volume status is "Resynching" because the server was hard-rebooted into rescue mode. This is an expected status and it is not caused by the rescue mode itself.

This will not affect data on the volume and resynchronization will continue once the server is rebooted on its installed OS.

Warning

NOTE: You must then use the path of your local Windows directory (here it is E:\Windows) when browsing to find the "SAM" configuration file below.

You can now reset the password by following the instructions below.

B - Reset the password

To reset passwords, the tool NTPWEdit is required.

Once you are connected via Remote Desktop, open the browser and download it from its official website.

Navigate to the folder where the downloaded ZIP file is located and extract its content.

Next, open the ntpwedit64 executable to start the application.

In this interface, you can manipulate the SAM file to clear the admin user's password.

You must browse the local Windows drive to find your system's SAM file.

Click the more options button (...) to browse the drive containing your server's local Windows folder.

It usually is the Windows (E:\) drive.

Man customer rescue mode - step 9

Browse to E:\WINDOWS\SYSTEM32\CONFIG\.

Select and open the SAM file to display the user accounts by clicking Open.

Man customer rescue mode - step 11

Select the user account "admin" and click on Change password.

Man customer rescue mode - step 10

In the pop-up window, choose and verify your new password and click OK. Finish by clicking Save changes and Exit.

Warning

NOTE: The new password will be accepted regardless of complexity.

Keep in mind that this password will allow remote connection to the server once rebooted on its operating system.

After this, the server needs to be rebooted on the normal operating system.

Resetting the admin password using OVHcloud rescue mode

The following steps describe the process of changing the local admin password by using the OVHcloud rescue mode (Linux-based).

Step 1: Rebooting the server into rescue mode
Step 2: Mounting the system partition
Step 3: Clearing the current password
Step 4: Rebooting the server
Step 5: Setting a new password

Tip

Click each tab across the top to view all steps.

Step 1

Step 2

Step 3

Step 4

Step 5

Step 1: Rebooting the server into rescue mode

The system has to be started in rescue mode before the admin password can be changed.

For detailed instructions, please refer to the rescue mode guide.

Step 2: Mounting the system partition

Connect to your server via SSH (see our SSH introduction guide if needed). Since it is a Windows server, you will see partitions labeled “Microsoft LDM data”.

fdisk -l

Output:

Disk /dev/sda: 1.8 TiB, 2000398934016 bytes, 3907029168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 54A5B25A-75B9-4355-9185-8CD958DCF32A

Device          Start        End    Sectors  Size Type
/dev/sda1        2048     718847     716800  350M EFI System
/dev/sda2      718848     720895       2048    1M Microsoft LDM metadata
/dev/sda3      720896     980991     260096  127M Microsoft reserved
/dev/sda4      980992 3907028991 3906048000  1.8T Microsoft LDM data
/dev/sda5  3907028992 3907029134        143 71.5K Microsoft LDM data

In the example output, “sda4” must be the (file) system partition, as determined by its size. Usually, there is a mirrored second output which in this case would be “/dev/sdbX“. That is because in most cases, the server will have multiple disks with identical partition schemes. For the password reset process, only the first one is important. Next, mount this partition:

mount /dev/sda4 /mnt

Verify the mountpoint:

lsblk

Output:

NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sdb      8:16   0  1.8T  0 disk
├─sdb4   8:20   0  1.8T  0 part
├─sdb2   8:18   0    1M  0 part
├─sdb5   8:21   0 71.5K  0 part
├─sdb3   8:19   0  127M  0 part
└─sdb1   8:17   0  350M  0 part
sda      8:0    0  1.8T  0 disk
├─sda4   8:4    0  1.8T  0 part /mnt
├─sda2   8:2    0    1M  0 part
├─sda5   8:5    0 71.5K  0 part
├─sda3   8:3    0  127M  0 part
└─sda1   8:1    0  350M  0 part

In the example above, the operation succeeded. If the mounting failed, you might receive an error message like this:

The disk contains an unclean file system (0, 0).
Metadata kept in Windows cache, refused to mount.
Failed to mount '/dev/sda4': Operation not permitted
The NTFS partition is in an unsafe state. Please resume and shutdown
Windows fully (no hibernation or fast restarting), or mount the volume
read-only with the 'ro' mount option.

In this case, use the following command and then try to mount again.

ntfsfix /dev/sda4

mount /dev/sda4 /mnt

Step 3: Clearing the current password

This step involves manipulating the SAM file with a tool to clear the admin user’s password. Change to the appropriate directory and list the Windows users:

cd /mnt/Windows/System32/config
/mnt/Windows/System32/config#

chntpw -l SAM

Output:

chntpw version 140201, (c) Petter N Hagen
Hive <SAM> name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 686c <lh>
File size 65536 [10000] bytes, containing 8 pages (+ 1 headerpage)
Used for data: 359/39024 blocks/bytes, unused: 33/18064 blocks/bytes.

| RID -|---------- Username ------------| Admin? |- Lock? --|
| 03e8 | admin                          | ADMIN  | dis/lock |
| 01f4 | Administrator                  | ADMIN  | dis/lock |
| 01f7 | DefaultAccount                 |        | dis/lock |
| 01f5 | Guest                          |        | dis/lock |
| 01f8 | WDAGUtilityAccount             |        | dis/lock |

If the command does not work, install the tool first: apt get install chntpw.

Clear the password for the admin user with the following command. (Choose “Administrator” if “admin” does not exist.)

chntpw -u admin SAM

Output:

chntpw version 140201, (c) Petter N Hagen
Hive <SAM> name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 686c <lh>
File size 65536 [10000] bytes, containing 8 pages (+ 1 headerpage)
Used for data: 361/39344 blocks/bytes, unused: 35/13648 blocks/bytes.

================= USER EDIT ====================

RID     : 1000 [03e8]a
Username: admin
fullname:
comment :
homedir :

00000221 = Users (which has 3 members)
00000220 = Administrators (which has 2 members)

Account bits: 0x0010 =
[ ] Disabled        | [ ] Homedir req.    | [ ] Passwd not req. |
[ ] Temp. duplicate | [X] Normal account  | [ ] NMS account     |
[ ] Domain trust ac | [ ] Wks trust act.  | [ ] Srv trust act   |
[ ] Pwd don't expir | [ ] Auto lockout    | [ ] (unknown 0x08)  |
[ ] (unknown 0x10)  | [ ] (unknown 0x20)  | [ ] (unknown 0x40)  |

Failed login count: 0, while max tries is: 0
Total  login count: 5

- - - - User Edit Menu:
 1 - Clear (blank) user password
(2 - Unlock and enable user account) [seems unlocked already]
 3 - Promote user (make user an administrator)
 4 - Add user to a group
 5 - Remove user from a group
 q - Quit editing user, back to user select
Select: [q] >

Type “1” and press Enter (“↩”). (Make use of option 2 first if there is an “X” next to “Disabled”.)

Select: [q] > 1
Password cleared!
================= USER EDIT ====================

RID     : 1000 [03e8]
Username: admin
fullname:
comment :
homedir :

00000221 = Users (which has 3 members)
00000220 = Administrators (which has 2 members)

Account bits: 0x0010 =
[ ] Disabled        | [ ] Homedir req.    | [ ] Passwd not req. |
[ ] Temp. duplicate | [X] Normal account  | [ ] NMS account     |
[ ] Domain trust ac | [ ] Wks trust act.  | [ ] Srv trust act   |
[ ] Pwd don't expir | [ ] Auto lockout    | [ ] (unknown 0x08)  |
[ ] (unknown 0x10)  | [ ] (unknown 0x20)  | [ ] (unknown 0x40)  |

Failed login count: 0, while max tries is: 0
Total  login count: 5
** No NT MD4 hash found. This user probably has a BLANK password!
** No LANMAN hash found either. Try login with no password!

- - - - User Edit Menu:
 1 - Clear (blank) user password
(2 - Unlock and enable user account) [seems unlocked already]
 3 - Promote user (make user an administrator)
 4 - Add user to a group
 5 - Remove user from a group
 q - Quit editing user, back to user select
Select: [q] >

Type "q" and press Enter to quit the tool. Type "y" when prompted and press Enter.

Select: [q] > q

Hives that have changed:
 #  Name
 0  <SAM>
Write hive files? (y/n) [n] : y
 0  <SAM> - OK

Step 4: Rebooting the server

First, change the netboot back to Boot from the hard disk in your OVHcloud Control Panel (repeat the instructions in Step 1 but select Boot from the hard disk).

Back in the CLI, unmount the partition and restart the server with these commands:

cd

umount /mnt

reboot

Output:

Broadcast message from root@rescue.ovh.net on pts/0 (Wed 2020-05-27 11:28:53 CEST):

The system is going down for reboot NOW!

Setting a new password (IPMI/KVM)

In your OVHcloud Control Panel, navigate to the IPMI/KVM tab to open a KVM session.

Man change administration password - step 5

For a newer version of Windows

There should be a password expiration message in the login interface.

Man change administration password - step 6

The new password for the admin user must now be entered twice. However, the confirmation field is not yet visible, meaning you need to leave the first field blank, type your new password into the second field, then use the tabulator key ("↹") on the virtual keyboard to switch to the third field ("Confirm password"). Type the password again and click on the arrow to save it.

Man change administration password - step 7

Click on OK and you will be logged in.

Man change administration password - step 8

Go further

Browse all the Dedicated Servers guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.

Learn more about Dedicated Servers on the OVHcloud US website.