How to Recover a Lost Windows NT/2000/XP Administrator Password

To recover a lost Windows NT/2000/XP administrator password, users need local access to the machine. The first step is to boot the machine with a bootable floppy or CD that contains NTFS (NT File System) drivers. This will allow users to proceed to the next step, which is to recover or reset the Administrator password.

Boot the System with NTFS Drivers

Petter Nordahl-Hagen has created a good set of Linux-based bootdisks with NTFS support. Download this package from Offline NT Password & Registry Editor.

Users may also use their own bootable floppies or CDs as long as they have support for the NTFS file system and can run the utility they intend to use to recover the administrator password.

Note that this step is only required if the system uses NTFS as a filesystem. If the system uses a different filesystem, boot with drivers for that filesystem.

Recover the Administrator Password

To attempt to recover the Administrator password, use a tool like OpenWall’s John the Ripper with Olle Segerdahl’s NTLM patch, L0phtCrack, or LCP. John the Ripper runs on Unix, DOS, or Windows. L0phtCrack runs on Unix or Windows. LCP runs on Microsoft Windows.

To reset the Administrator password, use a tool like `chntpw,` which is included with Petter Nordahl-Hagen’s bootdisk package mentioned above.

Resetting the administrator password will give the user access to the system. Recovering the administrator password can give access to the system without being obvious to the legitimate sysadmin, and the user will also know the sysadmin’s administrator password, which may give the user access to other machines.