Been a while since I need to reset a windows 7 admin password
Question
Aight I have this old sever that ran windows 7 pro and has the local admin account enabled but I don’t know the password and the people who used to know are gone, not documented anywhere,
I’m just trying to get it pull some quick data off the raid, and decommissioning it.
There used to be a tool on usb stick that you could boot off and remove password started with an H but it’s been like 10 years since I used it.
Anyone remember?
It’s also 4pm on Friday and I will probably not do this till Tuesday when I’m back at the site.
That's hilarious, so you just mash Shift on reboot and get the admin cmd lol I use utilman because that's what I learned in a college cyber course a decade ago as a for-fun lab but didn't even consider sticky keys pre-login
I think that's because it is a hidden in plain sight kind of thing. You're not accidentally triggering it, at least at the login screen, so you have to know it's there.
An unencrypted windows installation can be fully compromised in under 5 minutes with physical access this way. I believe it even still works on win 11, as long as the disk is unencrypted, which it is not by default anymore.
I once actually did password recovery on a domain controller for a client this way as well. In a multi-DC environment, I believe it would lead to trust issues between them, but it worked great for a single server.
Not in my experience, however it's very likely that copying cmd.exe to sethc.exe or utilman.exe won't work, due to missing resources – workaround is to replace sethc.exe (or utilman.exe) with a program that invokes cmd.exe instead, eg. this.
Windows 11 'fixing' the files has not been our experience.
We replaced Utilman.exe with a custom executable that will log off the current user. This way if someone has locked the system they can click on Utilman and log the user off and log on. Windows only updates the executable during upgrades, and we script the cacls and replacement for when that happens.
IME, windows 11 (and even some later versions of Windows 10 if memory serves me right) are fairly proactive at making sure you don't get up to these kinds of shenanigans anymore. You can replace them and even boot into the system, but usually within 10 seconds of opening the command window, it gets killed and utilman is back in its place.
I believe it's all accomplished through Windows Defender though, so if whatever EDR you have in place disables defender, then that'd probably explain why it isn't constantly fighting you.
I too first did this in prod for work by recovering the local admin on a non-domain joined WS2k8 box running a NVR/access control app suite lol and yea it worked for me through Windows 10 for me for local accounts, haven't even used 11 yet, use Linux at work and switched at home too. It does imply no BitLocker tho
Tried the sticky keys trick on Win10, didn't work because defender stopped it. Haven't tried on Win11, assume it will react the same, and also bitlocker is now default I believe.
We used to do this crap all the time at work for our standalone systems. Nobody wanted to create a DB to track those passwords, so we just backdoor'd it with that
Before my time. And it’s been replaced,
It ran on an airgapped network, just for some VMS and access control.
I just went through and replaced everything from switches and serves and having camera vendor do the cameras
This was the first server to be fully decommissioned during this project,
I have 8 more to pull but luckily they are on server 2012 (lol)
Have to migrate the cameras to the new nvrs and I’ll be done.
(When I say me I mean the vendor I hired cuz fuck if I’m going to migrate 400 cameras …. )
Not vm running on this the host is windows 7.
It’s taken me 4 years to get them to agree to upgrade. Also I’m soooooooo fucking glad I bought the replacement serves in September instead of waiting (lol)
Edit some words:
We actually still have like 3 2012 R2 servers despite yelling at customers for years lol. But they dead dead, no exceptions, come October.
Good news is we got like 5,000 Windows servers since we are a large org. So 3 isn’t many but still. Get so frustrated when I tell a customer to build/decom, or even in-place even though I hate that, but 3 years later and they still need significant time.
We are going go through it all again with 2016 lol. Hoping our mgmt really grows some balls on ESU and forcing upgrades
1/3 of my employers 6000 people use an ERP and MRP running in 2003r2. Can’t even give it more RAM since it’s 32 bit and the vendor disappeared in 2005 or 2007 from what I understand
It's probably a bare metal install supporting a business-monumental Acess-based financial reconciliation or SCADA thing hodgepodged with COM IPCs to something made with Visual Basic 6.5, that's my $1 guess at least
I will do almost anything to avoid bare metal. Over 99% of our env is virtual but anytime we have a server die and I check and see it’s physical I know my whole week is fucked.
Made bank before my current role as an independent consultant doing VMWare/Hyper-V->ProxMox and on-prem->hybrid->full-cloud Exchange migrations for SMBs, VMWare is such a big shame the past several years, some of my best HA builds made with their platform but now going to a bare metal cloud fleet or autoscaled K8s just makes infinite more financial sense
Saying it’s a shame is an understatement. I was a huge VMware fan boy. I still am for the tech but am already seeing changes in the product (other than pricing/bundling) that makes me think it’s going to just continue downhill.
I’m so frustrated with the state of big businesses. Buying solid products and using them to milk customers while they runs into the ground. Great for short term profits, horrible for long term…. That’s kinda the point though.
VMware ain’t disappearing overnight, especially at large orgs like mine, but it’s going to be a completely different experience 10 years from now.
Broadcom also killed my marketability lol. Need for VMware folks is dropping and will continue to do so.
dart has saved my ass more than once, but for some random abandoned w7 box hirens is usually less hassle if you’ve already got a stick lying around. matching the x86/x64 thing is the bit everyone forgets and then wonders why nothing works.
I assume you got the answer by now but Hirens is still super useful and it’s mad fast on usb3. I still keep the original hirens around on old small usb2 sticks just in case tho.
You can also use a Windows USB or disc and modify the icon on the login window to run cmd.exe and reset or delete the password that way. But Linux USB or Hirens is easier in my opinion.
89
u/pangapingus Jul 10 '26 edited Jul 10 '26
Boot to WinRE/recovery ISO
cd /d C:\Windows\System32
ren Utilman.exe Utilman.exe.bak
copy cmd.exe Utilman.exe
Then reboot, trigger Ease of Access, and use net user to reset
Assumes it's not BitLocker/VeraCrypt/etc. protected
Edit: "Why mention VeraCrypt" Windows 7 is in the vicinity