How to Remove a Windows Password with a Linux Live CD

Back when I was a Windows user, I know I'm not the only one who has experienced password loss—that moment where you just can't remember your password. Sometimes it happens to the best of us. So, how can we get into the system without paying a local geek or geeksquad to do it? First, we have to look into how Windows stores their passwords.

When Windows saves your user passwords, it stores them in a SAM file. It stores users' passwords in a hashed format (in LM hash and NTLM hash). Since a hash function is one-way, this provides some measure of security for the storage of the passwords. However, this can still be bruteforced.

Some time ago there was an exploit that allowed you to delete the SAM file and log into any account without a password. This is fixed, since Windows no longer allows access to the SAM file while Windows is running. So today, we are going to use a Linux Live CD to remove a Windows password using the chntpw tool.


  • BackTrack 5 on a DVD, or a Linux install with chntpw
  • A password on a Windows installation

Step 1: Boot From BackTrack

Text in bold is a terminal command.
  1. Put the disc in your computer.
  2. Hit the the setup button.
  3. Change CD/DVD to be first on the boot order.
  4. Exit the setup and save your settings.
  5. When you get to the console, boot with; user:root password:toor.
  6. Boot into the KDE desktop environment:
  7. Open a terminal.

Step 2: Mount Drive & Change Windows Password

Now we have to mount the Windows drive partition to modify the password, or remove it completely.
  1. First, we have to mount the hard drive partition that the Windows installation is located on..
        mount /dev/sda1 /mnt/
  2. Change to the directory that the SAM file is in so that we can prepare to modify its contents.
        cd /mnt//Windows/System32/config
  3. List the users on the computer contained in the SAM file.
      chntpw -l SAM
  4. Change a specific user account password.
        chntpw -u USERNAME SAM
  5. Now, lets unmount the drive and boot from Windows to use the updated or cleared password.
        umount /dev/sda1

Do you have questions, comments, or suggestions? Feel free to post a comment! 

Subscribe to Saint Andrew's Paradise
Liked this post?

Subscribe to "Saint Andrew's Paradise" and get all new tricks, tools and regular updates to your inbox!


Share your views...

0 Respones to "How to Remove a Windows Password with a Linux Live CD"

Post a Comment


About Me

Saint Andrew is a computer science student. Saint Andrew is a founder of the blog Saint Andrew's Hacking Paradise.

His mission and the aim of this blog is to make the reader aware of the existing threats and describe them in comprehensible way.

"Saint Andrew's Hacking Paradise" is a place to Learn, Understand and Explore the facts of computer technology.

You are always welcome to contact us to suggest ideas, tips, or to ask questions.

© 2011 Saint Andrew's Hacking Paradise

This blog run on iThesis Theme & hosted by Blogger