remove windows 7 start up password

[pcpete]

I still had the cloned drive laying around so I came into the shop to give it a try before we deliver the computer in the morning. The simple registry edit in the following post worked beautifully

https://www.technibble.com/forums/threads/just-got-2-vista-computers-in-with-syskey-passwords.59145/

 

[pcpete]

I may have changed one other variable. I also tried an older restore point during his method. it said it failed then when I rebooted it said the restore completed. I am not sure if the restore fixed it or if it was the registry edit. I am going to reproduce this on a test computer and see what happens.

 

[Larry Sabo]

AK initially had a lengthy writeup about what to do but was deleted shortly after and I never made a copy when I initially saw it.

Here's what I snagged at the time:

AlicKlaar's Solution described on forensicfocus.com (breaks some Windows features but gets EFS data back):

Re: Syskey password on startup

    Posted: Sun Jun 08, 2014 11:35 am
- jaclaz
Care to share some info on this? 
jaclaz

I was waiting for Jamie to review this thread. Last time I revealed  a workaround for a program the software company demanded the thread be removed   Lesson learned etc.

Anyhow, it's not rocket science, just joined up some dots. For EFS it's
documented that if the password is changed offline, then access is lost.
However, if you can restore the original password then it all works
again.

So,
1. obtain user login password by asking in my scenario / cracking with usual tools if required.
2. remove syskey (and blank password)
3. reset user password as per #1
4. reboot & login
5. access EFS / Export keys

I used Passcape's Reset Windows Password tool www.passcape.com/reset...s_password to reset the syskey.  The free tool from Petter Hagen pogostick.net/~pnh/ntpasswd/ is next on the list.

Pascape warn that  "After you reset the password, you may temporary lose
access to your Web site passwords, file share credentials, Wireless
connection passwords, EFS-encrypted files, e-mails encrypted with your
private keys, other personal data encrypted with DPAPI"

As Dr.McCoy said " it's worse than that..."

Somethings are definitely broken in the windows crypto as highlighted
with wifi security. WiFi can connect to open APs but WireShark shows no
packets are transmitted when you attempt to join WEP / WPA  / WPS
networks.  Normal LAN works fine but as this is in a VM or just a test
then it doesn't matter if you can get the files. I have tried resetting
perms on the Registry and Windows folder. I guess comparing before /
after reg is a logical step.

Insecurety Research has a write up on SAMSRV.dll insecurety.net/?p=768

Well that's it. It works for me. Hopefully it may be of some use for you too.

alice

 

[Markverhyden]

Thanks Larry. Copied it.

 

[pcpete]

I was just thinking, even if system restore is not an option, wouldn't a manual restore from c:\windows\system32\config\regback be a viable solution?