Chntpw

From Leo's Notes
Last edited on 14 June 2020, at 22:00.

chntpw, short for Change NT Password, is a utility for updating or clearing Windows account passwords by modifying the SAM database directly. This utility runs only on Linux and can be found on some live CD images including Clonezilla.

Usage

Boot into a linux distro or live CD with the utility. The examples below was done using Clonezilla.

## Mount your Windows partition
# mount /dev/sda1 /mnt

## Locate the SAM database
# cd /mnt/Windows/System32/config
# file SAM
SAM: MS Windows registry file, NT/2000 or above

## Edit or clear the password using chntpw
# chntpw SAM

Caveats

If your Windows partition is encrypted, you will probably be unable to mount the Windows partition properly.

Changing passwords might not work for recent versions of Windows. Try clearing the password instead.