Original Article
Abstract
I have recently installed a Windows 2003 Server at home and I set up a local domain using Active Directoryfeatures. Everything worked fine until I changed the Domain Admin password. It seems that I mistyped the newpassword twice (which I would attribute to the previous heavy night OUT, AND, WELL, I COULD NOT LOG ON THE DOMAIN Controller Anymore (I DID NOT HAVE A Backup Admin Account, i do now!).
A Few Tricks About Resetting The Domain Admin Password on Windows 2000 Server Have Been Published, Butafter Microsoft Strengthened Some Security Aspects on Windows 2003 Server, Those Hacks Do Not Work Anymore.
After Struggling A Few Days, I Finally Managed to Reset The Domain Account and I am Going to Present The Trickto You in this Paper.
THIS TRICK HAS A FEW IMPORTANT Requirements, Be Sure You Meet Therm Before Yelling At Me.
This Paper Does Not Intend to Serve Any Sort of Hackets, But Just Lousy Administrators (Like Me).
Requirements
THESE Are Compulsory!
You ued:
1 / Local Access To The Domain Controller (DC) .2 / The Local Administrator Password. 3 / Two Tools Provided by Microsoft In Their Resource Kit: Srvany and INSTSRV. Download Them from here.
The Local Administrator Account IS Also Called Directory Restore Administrator or Machine Account. The Password IS Set At Windows Installation. It is Possible To RESET this Password Using Some (Free) Recovery Tools.
The Trick Has Been Tested ON A Domain with a single dc. If you Domain Has Multiple DCS, IT Should Not Matter Which One You Decide To Use.
Let's get started
STEP 1
RESTART Windows 2003 in Directory Restory Service Mode.
Note: At Startup, Press F8 and Choose Directory Restore Service Mode. It Disables Active Directory.
WHEN The Login Screen Appears, LOG ON AS LOCAL Administrator. You now have the computer resources, but you can bannot make any changes to active Directory.step 2
You are now going to install SRVANY. This utility can virtually run any programs as an NT Service. The interestingpoint is that the program will have SYSTEM privileges (as it inheritates SRVANY security descriptor), ie it willhave full access on the system. That is More Than Enough To RESET. You Will Configure Srvany To Start The Command Prompt (Which Will Run The 'Net User' Command).
Copy SRVANY AND INSTSRV TO A TEMPORY FOLDER, MINE IS CALLED D: / TEMP. COPY CMD.EXE TO THIS FOLDER TOO (cmd.exe iSthe Command Prompt, USUALLY LOCATED AT% WINDIR% / system32).
Start A Command Prompt, Point To D: / Temp (or Whatever You Call IT), And Type: INSTSRV PassRecovery "D: /Temp/srvany.exe" (Replace D: / Temp with your folder name)
IT is now time to configure srvany.
Start regedit, Andokeen the key hkey_local_machine / system / currentcontrolset / service / passrecovery.
Create a New Subkey Called Parameters and Add Two New Values:
Name: ApplicationType: REG_SZ (String) Value: D: /Temp/cmd.exe
Name: AppParametersType: Reg_sz (String) Value: / K Net User Administrator New_Password
'Net user username password' is the command line utility to set a new password. Replace new_password with thepassword you want. Keep in my mind that some domain policies require complex passwords (including digits, respecting a minimal length etc.)
NOW Open The Services Applet (Control Panel / Administrative Tools / Services) and Open the passrecovery property Tab.check the starting mode is set to automatic.
Show the log on tab and enable the Option Allow Service To Interact with Desktop.from Now on, Anytime You Restart Windows, Srvany Will Run The Netuser Command and RESET The Domain Admin Password.
STEP 3
Restart Windows in normal mode and wait for the login screen. You will not see the command prompt running the net usercommand as it is displayed on another desktop. But no worries, the command is still executed in the background.
.
....................
Use this Command Prompt to Uninstall Srvany (Do Not Forget to Do It!) By Typing:
Net Stop PassRecoverySC Delete PassRecovery
Now delete d: / temp and change the admin Password if you fancy.
Voila!
Comments, Feedback
Feel Free to Give Me Your Comments and feedback. Send an email to seb@nobodix.org But do NOT Expect A Quick Answer from me.
