"Gene E. Bloch" wrote:
> Nancy wrote:
>> I have a w7 pro 64bit machine I removed from the domain in order to
>> change the local admin password to send the machine in for service. But
>> the local admin account was disabled.
Why did you remove the machine from the domain? There's no need to do that
to either use or change a local account password unless the domain is
imposing an unreasonably limiting GPO on the machine, in which case your
situation nicely demonstrates why it's not a good idea.
By default the local ADMINISTRATOR account is disabled in Windows 7. You
have to take explicit steps to enable it. (This can also be done by a GPO.)
There should be at least one additional local account that has local
administrator privileges.
One other possibility to consider: some organizations not only disable the
local Administrator account; they also rename it to something else, then
create a totally unprivileged local account named "ADMINISTRATOR" to serve
as a target for malware: even if the malware succeeds in hacking into that
account it has no privileges that can be exploited. The usable account with
local administrator rights will be something else.
>> I managed to enable it, but it
>> does not have a blank password or any password I would have assigned to
>> it as it will not let me log in with anything I can think of to try.
How did you enable the account? If you were able to gain the right to do
that you should have had the right to change its password.
>> Can I reset the local admin password through the recovery console or
>> something? Thanks.
I'm guessing that the domain was at your place of work. Have you
talked to the IT staff there? It's not unlikely that they've run
into this problem repeatedly and have a tool they've tested and found
to work that will forcibly change the password.
> If you didn't create a password reset disk, you'll have to track down
> some third party password resetting software. I have no idea whether any
> such software exists for free or at a reasonable price.
....and if you find a tool that does that, make certain that it's known to
work with Windows 7. Last fall I ran some tests of the old Winternals ERD
against 32-bit Windows 7; I've been using that tool for years when people
pull their XP systems out of the domain and don't know their local
administrator password...but it trashed the Win7 system. (The saving grace:
I was going to reformat the disk anyway so I lost nothing of interest.)
I wasn't completely surprised; even on XPSP3 the ERD frequently left the
volume dirty bit set, strongly suggesting that it didn't quite know how to
handle the latest tweaking of NTFS.
I've not had that happen again but I'm very leery of using tools that aren't
explicitly known to be compatible with Windows 7. I have a copy of DaRT in
house, but since we use 64-bit Win7 I'm stuck until Checkpoint finally
ponies up a 64-bit DaRT-compatible interface for the Pointsec full-disk
encryption tool.
Joe Morris
6 -0500, Nancy wrote: