Setting the domain password without knowing it

[jeff.sadowski]

I did some slight modifications to the instructions I found here

I build a script to do it for me. I built my own cd with chntpw and my script and the srvany.exe to reset a domain's Administrative password

rem This script was writen by Jeff Sadowski following instructions from

rem http://www.nobodix.org/seb/win2003_adminpass.html

rem I did a few things differently but its basically the same procedure

rem create a directory to put the tools

set passrec=c:\passrec

mkdir %passrec%

copy srvany.exe %passrec%

rem install srvany as a service called PassRecovery

sc create PassRecovery binPath= "%passrec%\srvany.exe" start= auto type= interact type= own

rem start creating a registry file to add the necessary arguments to srvany

echo REGEDIT4 > %passrec%\passrec.reg

echo [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PassRecovery\Parameters] >> %passrec%\passrec.reg

REM replace single \'s with two so the regedit will put them in

echo "Application"="%WINDIR:\=\\%\\System32\\cmd.exe" >> %passrec%\passrec.reg

rem create vbscript to complete the registry file with a password that gets typed in

echo password=InputBox("password:") > %passrec%\password.vbs

echo Set objShell = WScript.CreateObject("WScript.Shell") >> %passrec%\password.vbs

echo double_greater=">>" >> %passrec%\password.vbs

echo command="cmd /C echo ""AppParameters""=""/k net user administrator " ^& password ^& " /domain"" " ^& double_greater ^& " %passrec%\passrec.reg" >> %passrec%\password.vbs

echo objShell.Run command, 1, True >> %passrec%\password.vbs

wscript %passrec%\password.vbs

rem use the registry file to add the entries

regedit /s %passrec%\passrec.reg

del %passrec%\password.vbs

del %passrec%\passrec.reg

rem create a removal script to run after the server is back up

echo net stop PassRecovery > %passrec%\uninstall.bat

echo sc delete PassRecovery >> %passrec%\uninstall.bat

echo pause >> %passrec%\uninstall.bat

pause