Fernando Ronci
2010-04-20 18:56:16 UTC
Hi,
A client called me to restore access to their Windows 2003 Server acting as
a DC whose Administrators' passwords have been lost. Nobody can now log into
the server. I understand that resetting the local Administrator password on
non-Active Directory Win 2003 machines is pretty easy. There are lots of
utilities that you can download and run from a bootable CD and clear out the
passwords. I also understand that the mechanism that Windows 2003 Server
employs for storing usernames and passwords is different for Domain
Controller machines and WORK_GROUP ones, such that running any
password-resetting utility from a bootable CD is not enough for the former
case.
So my question is: How do I regain access to the Win 2003 Server machine
when neither the password of the local Administrator account nor the
"Directory Services Restore Mode Administrator Password" (asked by the
Active Directory Installation Wizard during the configuration of the DC) are
known? I followed the instructions on the site
http://www.nobodix.org/seb/win2003_adminpass.html to no avail. The
instructions detailed in that document fail because the log on window
doesn't recognize the LOCAL admin password, which I previously cleared out
from a bootable CD. The fact is that when you boot into Directory Restore
Service Mode (by pressing F8 at boot time) the requested password is the
"Directory Services Restore Mode Administrator Password", not the password
of the LOCAL Administrator account. I can confirm it because I tested it on
a non-production machine.
To put it simple: Is there a way or utility to override the security
policies, if any, and reset/delete all the administrative passwords?
Thank you in advance.
Fernando
A client called me to restore access to their Windows 2003 Server acting as
a DC whose Administrators' passwords have been lost. Nobody can now log into
the server. I understand that resetting the local Administrator password on
non-Active Directory Win 2003 machines is pretty easy. There are lots of
utilities that you can download and run from a bootable CD and clear out the
passwords. I also understand that the mechanism that Windows 2003 Server
employs for storing usernames and passwords is different for Domain
Controller machines and WORK_GROUP ones, such that running any
password-resetting utility from a bootable CD is not enough for the former
case.
So my question is: How do I regain access to the Win 2003 Server machine
when neither the password of the local Administrator account nor the
"Directory Services Restore Mode Administrator Password" (asked by the
Active Directory Installation Wizard during the configuration of the DC) are
known? I followed the instructions on the site
http://www.nobodix.org/seb/win2003_adminpass.html to no avail. The
instructions detailed in that document fail because the log on window
doesn't recognize the LOCAL admin password, which I previously cleared out
from a bootable CD. The fact is that when you boot into Directory Restore
Service Mode (by pressing F8 at boot time) the requested password is the
"Directory Services Restore Mode Administrator Password", not the password
of the LOCAL Administrator account. I can confirm it because I tested it on
a non-production machine.
To put it simple: Is there a way or utility to override the security
policies, if any, and reset/delete all the administrative passwords?
Thank you in advance.
Fernando