How to reset Windows administrator password

Strong system security requires equally strong passwords, which, in turn, make the passwords more difficult to remember. In such a case that the password for the Windows administrator user account is lost without an alternative method, you might end up locked out of your system. Resetting the Administrator password of your Windows cloud server is straightforward and will, typically, only take a few minutes to complete.

Setting up the password reset environment

1. Create an on-demand backup of your Windows storage device, so you can restore it if something goes wrong.

2. Shut down your Windows server. Go to the server in the Control Panel, click Shut down and confirm with Shut down. You don't need to sign in to Windows for this.

3. Once the Windows server has shut down, go to its Storage tab in the UpCloud Control Panel.

4. Take note of the storage device name. Then click the detach (eject) icon next to the storage device, and confirm with Detach.

5. Deploy a new Linux server in the same location as your Windows server. Storage devices can only be attached to servers in the same location. This guide uses Ubuntu, so the commands below use apt. Under Login Method, select an SSH key, as you'll connect to the server with SSH.

6. Once your temporary Linux server has started, shut it down with Shut down on its Overview tab.

7. Once the temporary Linux server has shut down, go to its Storage tab and click Attach existing storage.

In the Attach existing device dialog, click the Device list drop-down.

Select the Windows storage device, and click Add a storage device.

Note: The Device list only shows storage devices that aren't attached to a server and are in the same location as the Linux server. If your Windows storage device isn't listed, check that you detached it from the Windows server and deployed the Linux server in the same location.

Your Linux server now has two storage devices.

8. Start the temporary Linux server.

Working with chntpw and ntfs-3g

1. Connect to your temporary Linux server using SSH.

ssh root@<server-ip-address>

2. Update the package lists and install chntpw and ntfs-3g.

apt update
apt install chntpw ntfs-3g -y

3. Find the name of your Windows storage device.

lsblk

NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
vda    253:0    0   25G  0 disk
├─vda1 253:1    0    1M  0 part
└─vda2 253:2    0   25G  0 part /
vdb    253:16   0   50G  0 disk
├─vdb1 253:17   0  100M  0 part
└─vdb2 253:18   0 49.9G  0 part

The Linux server's own storage device is vda, mounted at /. The Windows storage device is vdb, and the Windows partition is the larger one, vdb2. Use the -p flag to see the full device paths.

Note: sfdisk -l or any other preferred method will work as well.

4. Create a mount point for the Windows storage.

mkdir /mnt/Microsoft/

5. Mount the Windows partition to the /mnt/Microsoft directory. With ntfs-3g installed, this mounts the partition with read and write access.

mount -o rw /dev/vdb2 /mnt/Microsoft/

6. Use chntpw to begin resetting the Administrator password.

chntpw -i /mnt/Microsoft/Windows/System32/config/SAM

You will now see the chntpw console. Type "1" and hit Enter to select "Edit user data and passwords".

chntpw version 1.00 140201, (c) Petter N Hagen
Hive </mnt/Microsoft/Windows/System32/config/SAM> name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 686c <lh>
File size 65536 [10000] bytes, containing 7 pages (+ 1 headerpage)
Used for data: 343/36312 blocks/bytes, unused: 33/8520 blocks/bytes.
  
<>========<> chntpw Main Interactive Menu <>========<>
  
Loaded hives: </mnt/Microsoft/Windows/System32/config/SAM>
  
 1 - Edit user data and passwords
 2 - List groups
  - - -
 9 - Registry editor, now with full write support!
 q - Quit (you will be asked if there is something to save)
  
What to do? [1] -> 1  # Type: 1 > Enter

Enter the user ID (RID) for the Administrator username, which is 01f4, and hit Enter.

===== chntpw Edit User Info & Passwords ====

| RID -|---------- Username ------------| Admin? |- Lock? --|
| 01f4 | Administrator                  | ADMIN  |          |
| 01f7 | DefaultAccount                 |        | dis/lock |
| 01f5 | Guest                          |        | dis/lock |
| 01f8 | WDAGUtilityAccount             |        | dis/lock |

Please enter user number (RID) or 0 to exit: [1f4] 01f4   # Type: 01f4 > Enter

Select "1" from the list to "Clear (blank) user password" and hit Enter.

================= USER EDIT ====================

RID     : 0500 [01f4]
Username: Administrator
fullname:
comment : Built-in account for administering the computer/domain
homedir :

00000220 = Administrators (which has 1 members)

Account bits: 0x0010 =
[ ] Disabled        | [ ] Homedir req.    | [ ] Passwd not req. |
[ ] Temp. duplicate | [X] Normal account  | [ ] NMS account     |
[ ] Domain trust ac | [ ] Wks trust act.  | [ ] Srv trust act   |
[ ] Pwd don't expir | [ ] Auto lockout    | [ ] (unknown 0x08)  |
[ ] (unknown 0x10)  | [ ] (unknown 0x20)  | [ ] (unknown 0x40)  |

Failed login count: 0, while max tries is: 0
Total  login count: 10

- - - - User Edit Menu:
1 - Clear (blank) user password
(2 - Unlock and enable user account) [seems unlocked already]
3 - Promote user (make user an administrator)
4 - Add user to a group
5 - Remove user from a group
q - Quit editing user, back to user select
Select: [q] > 1                                   # Type: 1 > Enter
Password cleared!

Now hit q and q again to exit this console, and then hit y to save your changes.

- - - - User Edit Menu:
1 - Clear (blank) user password
(2 - Unlock and enable user account) [seems unlocked already]
3 - Promote user (make user an administrator)
4 - Add user to a group
5 - Remove user from a group
q - Quit editing user, back to user select
Select: [q] > q                                   # Type: q > Enter

<>========<> chntpw Main Interactive Menu <>========<>

Loaded hives: </mnt/Microsoft/Windows/System32/config/SAM>

 1 - Edit user data and passwords
 2 - List groups
     - - -
 9 - Registry editor, now with full write support!
 q - Quit (you will be asked if there is something to save)

What to do? [1] -> q                              # Type: q > Enter

Hives that have changed:
 #  Name
 0  </mnt/Microsoft/Windows/System32/config/SAM>
Write hive files? (y/n) [n] : y                   # Type: y > Enter
 0  </mnt/Microsoft/Windows/System32/config/SAM> - OK

7. Once all the above steps have been completed, shut down the temporary Linux server.

shutdown -h now

Setting a new Administrator password

1. In the Control Panel, go to the temporary Linux server's Storage tab. Click the detach (eject) icon next to the Windows storage device, and confirm with Detach.

2. Go to your Windows server's Storage tab and click Attach existing storage.

Select your Windows storage device from the Device list, and click Add a storage device.

3. Start the Windows server, and wait for it to boot.

4. Go to your Windows server's Console tab and click Open the console connection.

Because the password was cleared, Windows logs you in as the Administrator user without asking for a password. This is insecure, so set a new, strong password straight away.

5. Search for and open Computer Management.

Navigate the folder structure via: Computer Management (Local) > System Tools > Local Users and Groups > Users.

• Right-click Administrator and click Set Password....

• Click Proceed, enter the new password twice, and click OK.

Note: By default, Windows enforces a certain password strength requirement.

• The password must not contain the user's account name or more than two consecutive characters from the user's full name.
• The password must be six or more characters long.
• The password must contain characters from three of the following four categories:
  • Uppercase characters A-Z (Latin alphabet)
  • Lowercase characters a-z (Latin alphabet)
  • Digits 0-9
  • Special characters (!, $, #, %, etc.)

6. After you have set your Administrator password, sign out and back in to check that your new password works.

Cleanup

Once everything is working as expected with your new Windows Administrator password, delete the temporary Linux server. Open its server page, click the arrow next to Start and select Delete. The Delete server dialog lists the storage devices attached to the server, which are deleted with it. Check that only the Linux server's own storage device is selected before you click Delete.

You can also delete the on-demand backup you took at the start of this process, if you no longer need it.

Common issues

1. The disk contains an unclean file system (0, 0).

The disk contains an unclean file system (0, 0).
Metadata kept in Windows cache, refused to mount.
Falling back to read-only mount because the NTFS partition is in an unsafe state. Please resume and shutdown Windows fully (no hibernation or fast restarting)

To resolve this error, you will need to properly shut down the Windows server by following these steps:

1. Shut down the temporary Linux server.
2. Detach the Windows storage from the temporary Linux server.
3. Attach the Windows storage back to the Windows server.
4. Start the Windows server, and wait for it to boot.
5. Shut down the Windows server with Shut down in the Control Panel.

After this is done, attach the Windows storage to the Linux server again and restart the Windows password reset process.