--- title: "How to reset the administrator password on a Windows server" description: "Learn how to reset your Administrator account password with the Windows customer rescue system." url: https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/reset-administrator-password-windows-server lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # How to reset the administrator password on a Windows server **Learn how to reset your Administrator account password with the Windows customer rescue system.**   ## Requirements - Microsoft Windows installed on your [dedicated server](https://us.ovhcloud.com/bare-metal/) - At least 16 GB of RAM installed on the server - Access to the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/) **Warning:** **NOTE:** This guide is not applicable to the legacy Windows rescue system (WinPE rescue mode); see our [rescue mode guide](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/rescue-mode.md) for more information. If your Windows Server version is out of support, you might no the able to activate the current rescue system for Windows. In this case, you can use an alternative method for resetting the administrator password using the [OVHcloud customer rescue system based on Debian](#resetting-the-admin-password-using-ovhcloud-rescue-mode).   ## Topics - [Resetting the admin password using the OVHcloud Windows Customer Rescue System](#resetting-the-admin-password-using-the-ovhcloud-windows-customer-rescue-system) - [Resetting the admin password using OVHcloud rescue mode](#resetting-the-admin-password-using-ovhcloud-rescue-mode)   ## Instructions ### Resetting the admin password using the OVHcloud Windows Customer Rescue System - Step 1: Reboot the server into rescue mode - Step 2: Clear the current password - Step 3: Reboot the server #### Step 1 #### Step 1: Reboot the server into rescue mode The system has to be started in the **Windows customer rescue system** before the admin password can be changed. For detailed instructions, please refer to the [Windows rescue mode guide](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/rescue-customer-windows.md). ##### Step 2 #### Step 2: Clear the current password Connect to your server in Remote Desktop using the credentials provided by email. Please note that the username for the rescue mode is `Administrator`. - If your server uses software RAID on your Windows disk, you have to import your Windows local disk to be able to access it: Follow the instructions in [section A](#a-importing-your-local-windows-disk) below. - If your server does not use software RAID on your Windows disk, you should be able to directly access the local Windows disk as explained in [section B](#b-reset-the-password) of this guide. ##### A - Importing your local Windows disk **Access disk management** Right-click the `Start` menu and select `Disk Management`. You can then see the disks and volumes of the server. Your server's Windows disk is probably _Disk 1_. You must import it to be able to access it. Please note that if you have several disk groups, the number of the Windows disk may vary. You may have to import several disks to get the Windows one. You also have to import the second disk to properly import your software RAID volume.   **Import local disks** Right-click _Disk 1_ and select `Online`. Do the same thing for the second disk (_Disk 2_) to properly import your software RAID volume. Right-click _Disk 2_ and select `Online`. Disks are now seen as "Dynamic" and "Foreign". Right-click _Disk 1_ again and select `Import Foreign Disks`. Click `OK` twice. You can see that the local disk is now accessible and that the Windows disk is drive `(E:)` (spreading on two software RAID disks with Mirrored volume type). **Note:** In this example, the volume status is "Resynching" because the server was hard-rebooted into rescue mode. This is an expected status and it is not caused by the rescue mode itself. This will not affect data on the volume and resynchronization will continue once the server is rebooted on its installed OS. **Warning:** **NOTE:** You must then use the path of your local Windows directory (here it is `E:\Windows`) when browsing to find the "SAM" configuration file below. You can now reset the password by following the instructions below. ##### B - Reset the password To reset passwords, the tool NTPWEdit is required. Once you are connected via Remote Desktop, open the browser and download it from its [official website](http://cdslow.org.ru/en/ntpwedit/). Navigate to the folder where the downloaded ZIP file is located and extract its content. Next, open the `ntpwedit64` executable to start the application. In this interface, you can manipulate the SAM file to clear the admin user's password. You must browse the local Windows drive to find your system's SAM file. Click the _more options_ button (`...`) to browse the drive containing your server's local Windows folder. It usually is the `Windows (E:\)` drive. Browse to `E:\WINDOWS\SYSTEM32\CONFIG\`. Select and open the SAM file to display the user accounts by clicking `Open`. Select the user account "admin" and click on `Change password`. In the pop-up window, choose and verify your new password and click `OK`. Finish by clicking `Save changes` and `Exit`. **Warning:** **NOTE:** The new password will be accepted regardless of complexity. Keep in mind that this password will allow remote connection to the server once rebooted on its operating system. After this, the server needs to be rebooted on the normal operating system. ###### Step 3 ### Step 3: Reboot the server First, change the netboot back to "Boot from the hard disk" in your OVHcloud Control Panel. Then restart the server from the Control Panel. Click the _more options_ `...` button near "Status" in the **service Status** section and click `Restart`.   ### Resetting the admin password using OVHcloud rescue mode The following steps describe the process of changing the local admin password by using the OVHcloud rescue mode (Linux-based). - Step 1: Rebooting the server into rescue mode - Step 2: Mounting the system partition - Step 3: Clearing the current password - Step 4: Rebooting the server - Step 5: Setting a new password **Tip:** Click each tab across the top to view all steps. #### Step 1 #### Step 1: Rebooting the server into rescue mode The system has to be started in rescue mode before the admin password can be changed. For detailed instructions, please refer to the [rescue mode guide](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/rescue-mode.md). ##### Step 2 #### Step 2: Mounting the system partition Connect to your server via SSH (see our [SSH introduction guide](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/ssh-introduction.md) if needed). Since it is a Windows server, you will see partitions labeled “Microsoft LDM data”. ```bash fdisk -l ``` Output: ```text Disk /dev/sda: 1.8 TiB, 2000398934016 bytes, 3907029168 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: 54A5B25A-75B9-4355-9185-8CD958DCF32A Device Start End Sectors Size Type /dev/sda1 2048 718847 716800 350M EFI System /dev/sda2 718848 720895 2048 1M Microsoft LDM metadata /dev/sda3 720896 980991 260096 127M Microsoft reserved /dev/sda4 980992 3907028991 3906048000 1.8T Microsoft LDM data /dev/sda5 3907028992 3907029134 143 71.5K Microsoft LDM data ``` In the example output, “sda4” must be the (file) system partition, as determined by its size. Usually, there is a mirrored second output which in this case would be “/dev/sdb**X**“. That is because in most cases, the server will have multiple disks with identical partition schemes. For the password reset process, only the first one is important. Next, mount this partition: ```bash mount /dev/sda4 /mnt ``` Verify the mountpoint: ```bash lsblk ``` Output: ```text NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sdb 8:16 0 1.8T 0 disk ├─sdb4 8:20 0 1.8T 0 part ├─sdb2 8:18 0 1M 0 part ├─sdb5 8:21 0 71.5K 0 part ├─sdb3 8:19 0 127M 0 part └─sdb1 8:17 0 350M 0 part sda 8:0 0 1.8T 0 disk ├─sda4 8:4 0 1.8T 0 part /mnt ├─sda2 8:2 0 1M 0 part ├─sda5 8:5 0 71.5K 0 part ├─sda3 8:3 0 127M 0 part └─sda1 8:1 0 350M 0 part ``` In the example above, the operation succeeded. If the mounting failed, you might receive an error message like this: ```text The disk contains an unclean file system (0, 0). Metadata kept in Windows cache, refused to mount. Failed to mount '/dev/sda4': Operation not permitted The NTFS partition is in an unsafe state. Please resume and shutdown Windows fully (no hibernation or fast restarting), or mount the volume read-only with the 'ro' mount option. ``` In this case, use the following command and then try to mount again. ```bash ntfsfix /dev/sda4 ``` ```bash mount /dev/sda4 /mnt ``` ##### Step 3 #### Step 3: Clearing the current password This step involves manipulating the _SAM_ file with a tool to clear the admin user’s password. Change to the appropriate directory and list the Windows users: ```bash cd /mnt/Windows/System32/config /mnt/Windows/System32/config# ``` ```bash chntpw -l SAM ``` Output: ```text chntpw version 140201, (c) Petter N Hagen Hive name (from header): <\SystemRoot\System32\Config\SAM> ROOT KEY at offset: 0x001020 * Subkey indexing type is: 686c File size 65536 [10000] bytes, containing 8 pages (+ 1 headerpage) Used for data: 359/39024 blocks/bytes, unused: 33/18064 blocks/bytes. | RID -|---------- Username ------------| Admin? |- Lock? --| | 03e8 | admin | ADMIN | dis/lock | | 01f4 | Administrator | ADMIN | dis/lock | | 01f7 | DefaultAccount | | dis/lock | | 01f5 | Guest | | dis/lock | | 01f8 | WDAGUtilityAccount | | dis/lock | ``` If the command does not work, install the tool first: `apt get install chntpw`. Clear the password for the admin user with the following command. (Choose “Administrator” if “admin” does not exist.) ```bash chntpw -u admin SAM ``` Output: ```text chntpw version 140201, (c) Petter N Hagen Hive name (from header): <\SystemRoot\System32\Config\SAM> ROOT KEY at offset: 0x001020 * Subkey indexing type is: 686c File size 65536 [10000] bytes, containing 8 pages (+ 1 headerpage) Used for data: 361/39344 blocks/bytes, unused: 35/13648 blocks/bytes. ================= USER EDIT ==================== RID : 1000 [03e8]a Username: admin fullname: comment : homedir : 00000221 = Users (which has 3 members) 00000220 = Administrators (which has 2 members) Account bits: 0x0010 = [ ] Disabled | [ ] Homedir req. | [ ] Passwd not req. | [ ] Temp. duplicate | [X] Normal account | [ ] NMS account | [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act | [ ] Pwd don't expir | [ ] Auto lockout | [ ] (unknown 0x08) | [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) | Failed login count: 0, while max tries is: 0 Total login count: 5 - - - - User Edit Menu: 1 - Clear (blank) user password (2 - Unlock and enable user account) [seems unlocked already] 3 - Promote user (make user an administrator) 4 - Add user to a group 5 - Remove user from a group q - Quit editing user, back to user select Select: [q] > ``` Type “1” and press Enter (“↩”). (Make use of option 2 first if there is an “X” next to “Disabled”.) ```text Select: [q] > 1 Password cleared! ================= USER EDIT ==================== RID : 1000 [03e8] Username: admin fullname: comment : homedir : 00000221 = Users (which has 3 members) 00000220 = Administrators (which has 2 members) Account bits: 0x0010 = [ ] Disabled | [ ] Homedir req. | [ ] Passwd not req. | [ ] Temp. duplicate | [X] Normal account | [ ] NMS account | [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act | [ ] Pwd don't expir | [ ] Auto lockout | [ ] (unknown 0x08) | [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) | Failed login count: 0, while max tries is: 0 Total login count: 5 ** No NT MD4 hash found. This user probably has a BLANK password! ** No LANMAN hash found either. Try login with no password! - - - - User Edit Menu: 1 - Clear (blank) user password (2 - Unlock and enable user account) [seems unlocked already] 3 - Promote user (make user an administrator) 4 - Add user to a group 5 - Remove user from a group q - Quit editing user, back to user select Select: [q] > ``` Type "q" and press Enter to quit the tool. Type "y" when prompted and press Enter. ```text Select: [q] > q Hives that have changed: # Name 0 Write hive files? (y/n) [n] : y 0 - OK ``` ##### Step 4 #### Step 4: Rebooting the server First, change the netboot back to **Boot from the hard disk** in your [OVHcloud Control Panel](https://manager.us.ovhcloud.com/) (repeat the instructions in Step 1 but select `Boot from the hard disk`). Back in the CLI, unmount the partition and restart the server with these commands: ```bash cd ``` ```bash umount /mnt ``` ```bash reboot ``` Output: ```text Broadcast message from root@rescue.ovh.net on pts/0 (Wed 2020-05-27 11:28:53 CEST): The system is going down for reboot NOW! ``` ##### Step 5 #### Setting a new password (IPMI/KVM) In your [OVHcloud Control Panel](https://manager.us.ovhcloud.com/), navigate to the `IPMI/KVM` tab to open a KVM session.   #### For a newer version of Windows There should be a password expiration message in the login interface. The new password for the admin user must now be entered twice. However, the confirmation field is not yet visible, meaning you need to leave the first field blank, type your new password into the second field, then use the tabulator key ("↹") on the virtual keyboard to switch to the third field ("Confirm password"). Type the password again and click on the arrow to save it. Click on `OK` and you will be logged in.   ## Go further Browse all the [Dedicated Servers guides](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/landing-page-dedicated-servers.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Dedicated Servers](https://us.ovhcloud.com/bare-metal/) on the OVHcloud US website.