You can access the SAM by accessing hard disk with tools like ERD Commander
(www.winternals.com)

Next, decrypt the file using another tool like L0phtcrack,...

Good luck & regards,
Mathieu Guastella
IT Manager, CIO, MCSE
Field Resource | Alize Media | Media Enterprises Group | Publiroll

     Tel. Direct: +32 2 727 05 92
        Tel. General: +32 2 644 12 80
     Tel. Mobile: +32 495 56 83 21
     Fax: +32 2 727 05 91
      +32 2 727 05 90
      +32 2 705 89 80
     Mails: mathieu.guastellafieldresource.com
      it.managerfieldresource.com
      admingen.be
     Sites: www.gen.be
      www.fieldresource.com
      www.alize-media.com
      www.moodmedia.be
     Adress: Chaussee de Louvain 696
      Leuvensesteenweg 696
      1030 Brussels
      Belgium

     Services:

      PRIVILEGED - PRIVATE AND CONFIDENTIAL
      This electronic mail is solely for the use of the addressee and may
contain information which is confidential or privileged. If you receive this
electronic mail in error, please delete it from your system immediately and
notify the sender by electronic mail or using any of the above contact
details.

  -----Message d'origine-----
  De : Focus on Microsoft Mailing List [mailto:FOCUS-MSSECURITYFOCUS.COM]De
la part de Donald Hwong
  Envoye : samedi 7 avril 2001 11:02
  A : FOCUS-MSSECURITYFOCUS.COM
  Objet : Problems with Null Session

  I have a problem... I have a remote server that a disgruntled employee
changed the Administrator password on locked the desktop and left. I have
been trying to reset the password via a null session and usrmgr.exe as well
as Computer Management. I have no problem creating the Null Session.

  This is my output from the command

  net use \\xx.xx.xx.xx\ipc$ /user:xx.xx.xx.xx\Administrator

  Local name
  Remote name \\xx.xx.xx.xx\IPC$
  Resource type IPC
  Status OK
  # Opens 0
  # Connections 1
  The command completed successfully.

  But when I go to change the password with usrmgr.exe or computer
management I get an Access Denied message. Unfortunately this computer is
not a member of any domain, and I cannot reboot it because it is running a
propriatary app that will cause a bunch of troubles if it is not shutdown
properly, let alone the trouble I would get in for downtime on the box. All
the other accounts have been locked out...

  Please Help

  Donald Hwong

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]