Proj 10: Reset Windows Password with an Install Disk (15 pts)

Purpose

Often you need access to a Windows machine but you don't have the password. That's easily solved by booting from a Windows installation disk. This is a very old technique

What You Need

Booting from the ISO File

Launch VMware Player. On the left side, click your Windows 2016 machine. On the lower right, click "Edit virtual machine settings".

In the "Hardware" box, on the left side, click "New CD/DVD". On the right side, click the "Use ISO image file" button.

Click the Browse... button. Navigate to your Downloads folder and double-click the 4393.0.161119-1705.RS1_REFRESH_SERVER_EVAL_X64FRE_EN-US.ISO file, as shown below.

Click the Close button.

In VMware Player, on the lower right, click Play. A message appears saying "Press any key to boot from CD or DVD...", as shown below.

Troubleshooting

If you don't see the "Press any key to boot from CD or DVD..." message, you need to adjust the BIOS.

Here are instructions for the process for my old Windows 2008 VM; the process is similar for Windows 2016 except for the filename.

Lengthening the Bootup Process

We need to adjust the BIOS in the virtual machine, which is easier if it pauses when booting up.

Click Start, Computer. Open the drive and folder containing your Windows Server 2008 virtual machine.

Open the "Windows Server 2008 2.vmwarevm" folder.

Right-click the "Windows Server 2008 2.vmx" file and click "Open with...", as shown below.

In the "Open with" box, in the right center, click the down-arrow to show the Other Programs.

Find Wordpad and click it. (Notepad doesn't work well for this.)

Clear the "Always use the selected program to open this kind of file box.

Click OK.

The "Windows Server 2008 2.vmx" file opens in Wordpad. Scroll to the bottom and carefully type in this line, ensuring that is is exactly correct, including capitalization:

bios.bootDelay = "5000"
Your screen should now look like the image below (although you're using WordPad, not Notepad).

In Wordpad, click File, Save. Close Wordpad.

Adjusting the BIOS Boot Options

In VMware Player, start your Windows VM. VMware usually pops up some boxes telling you unimportant things, like some USB device you could use. Close them quickly.

You should see a black screen with a message at the bottom, saying "Press F2 to enter SETUP", as shown below.

Click in the black VMware Player window and press the F2 key on the keyboard. If you are too slow doing this, Windows will start. If that happens, log in and shut Windows down again normally.

When you succeed, you will see the BIOS, as shown below.

In the BIOS, press the right-arrow key on the keyboard three times to select "Boot Menu".

Press the down-arrow key on the keyboard enough times to select "CD-ROM Drive", as shown below.

Press the + key on the keyboard (using the Shift key) several times, to "CD-ROM Drive" to the top of the list, as shown below.

Press the F10 key on the keyboard to save changes.

Press the Enter key to confirm.

Click in the virtual machine window and press Enter.

A box appears asking what language to use, as shown below. Click Next.

In the next box, on the lower left, click "Repair your computer", as shown below.

Opening a Command Prompt

A "Choose an option" screen appears, as shown below. Click Troubleshoot.

An "Advanced options" screen appears, as shown below. Click "Command Prompt".

Modifying Utilman

In the Command Prompt window, execute these commands, as shown below. These commands put a copy of cmd.exe on top of the utilman.exe file, which is a very old trick that makes it possible to hack into Windows.

D:
cd windows\system32
ren utilman.exe utilman.exe.old
copy cmd.exe utilman.exe
shutdown -r -t 0

When your machine restarts, don't press a key to boot from the CD. Just let it proceed to the login page shown below.

Press the Windows logo key and the U key. (On a Mac, press Cmd+U.).

A Command Prompt opens, as shown below. Execute these commands to see how it works and reset the Administrator password--you are now "System", and therefore more powerful than the Administrator. Enter a new password twice when you are prompted to.


whoami
net user administrator *

Notice the words that appear before the username "system", covered by a gray box in the image above. Enter those words into the form below.

10: Recording Your Success (15 pts)

Use the form below to record your success.

Name:
Words:

Sources

How to Reset Forgotten Windows Server 2016 Password


VMware Boot Delay added 10-15-18