Reset domain Administrator account password using only your Windows installation media !

Do you know that you can reset your Active Directory Administrator account password without login into your Active Directory ? . In this post , I will explain in a step by step mode how you can do this using only  your Windows installation media which can be used to reset the Administrator account password if forgotten and you have no other user(s) with privilege(s) to do the reset.

For this tutorial I will use a virtualized domain controller with Windows Server 2008 R2 with SP1 as Operating System.

Here is the detailed procedure :

• Mount Windows Server 2008 R2 ISO/DVD 

• Restart your domain controller and choose to boot from DVD when prompted

• At “Install Windows”  click next

• At “Select the operating system you want to install” , pick the edition that matches your DC edition and click next

• For license agreement , accept and click next 

• For installation type choose Custom (advanced) and click next 

• When asked about location of Windows installation click Shift + F10

• A command line windows will appear, as below

• Use the command line window to do the following

1. Browse to Windows installation location drive ( for me its D:\ )
2. Browse to Windows\System32
3. Copy UtilMan.exe to UtilMan.exe.bak
4. Copy Cmd.exe to UtilMan.exe & accept overwrite
5. Reboot the server

D:

CD Windows\System32

Copy UtilMan.exe UtilMan.exe.bak

Copy Cmd.exe UtilMan.exe

Shutdown –r –t 0

• Once restarted , Click on Utility Manager button ( labeled 1 below ) , so an elevated command line window will open

• At command line windows execute Net User “Administrator” “The desired password for Administrator” , I used P@ssw0rd1234 as below :

Net User “Administrator” “P@ssw0rd1234”

• After re-setting the password , test login to your domain controller using the new password ( it will work ).

Now , We need to restore everything to its normal state – no CMD at login screen . To do so , reboot again and, proceed with the same steps till reaching CMD and go through the below commands

D:

CD Windows\System32

Move UtilMan.exe.bak UtilMan.exe

Shutdown –r –t 0

Now, you have successfully reset your Administrator password and restored your OS to its normal state.