Windows Server Hacks: Creating a Password Reset Diskby Mitch Tulloch, author of Windows Server Hacks
Depending on the machine and user involved, losing a password for an account can be anything from a pain to a disaster. Fortunately, in Windows Server 2003 and Windows XP there's something you can do to prepare for such an eventuality: create a password reset disk.
In Windows Server 2003 you can create a password reset disk for any local user account on a member server (a nondomain controller in a domain) or stand-alone server (a server in a workgroup). You can't create a password reset disk for a domain controller because a domain controller doesn't have any local user accounts, only domain accounts stored in Active Directory.
A typical use for a password reset disk would be to create one for the all-powerful local Administrator account on your server. To do this, get a blank formatted floppy and follow these steps:
Ctrl-Alt-Delto open the Windows Security dialog box.
Administrator--whose password you want to be able to reset.
TEST210 (this computer).
Put your password reset disk in a secure location--especially if you created it for the local Administrator account on your server, because anyone who gets hold of your reset disk can log on to the machine and have unlimited access.
What if you lose your password and you need to log on to your machine? That may sound unlikely, but what if the administrator who installed the server is sick or out of the office and you can't remember the password? Simply dig out your password reset disk (hopefully you know where to find it) and do the following:
Running the Forgotten Password wizard creates a public/private key pair for the local user account you specified in the Change Password box. The private key is then stored on the reset disk while the public key is stored on the hard drive and used to encrypt the current password for your user account. Then, if you later have to run the Reset Password wizard, the private key on your floppy is used to decrypt the account's current password, and when you enter a new password for the account, this new password is encrypted using the same public key. This means you can use the same password reset disk to reset the password for your account as many times as you need to. It also means the password reset disk itself can't be hacked to extract the account's password, as it contains only a cryptographic key rather than the password itself.
A few things can go wrong when you use password reset disks. First and most obvious, if you run the Forgotten Password wizard a second time to create a new password reset disk, this generates a new public/private key pair for the account and invalidates the previous reset disk. So if you're really paranoid and want to create multiple reset disks, run the wizard only once, then make duplicates of the reset disk and store them in different secure locations.
More subtly, I encountered an interesting problem the first time I tried this approach for recovering the local Administrator password on a Windows Server 2003 member server. I created a password reset disk using the procedure described above and then tried to use it to reset the account password as outlined. But when I specified a new password and clicked Next, a message appeared saying, "The new password is too short or otherwise unusable due to the policy settings for this computer." Opening the Default Domain Policy in Group Policy Editor revealed that my Password Policy settings included a minimum password age of two days:
Figure 1. The minimum password age can prevent passwords from being reset.
What this policy setting means is that if you change the password for an account, you have to wait an additional two days before you can change it again. And guess what; I had changed the password for the local Administrator account on the machine just before I created my password reset disk. (I had demoted the machine from the role of domain controller to member server, which always entails specifying a new password for the local Administrator account.) So I changed the minimum password age policy setting to zero days, ran
gpupdate /force on the member server, tested the reset disk (it worked), and then changed the policy setting back again. Funny how things can trip you up, but hey, that's life as a sysadmin!
For other approaches to recovering passwords for accounts when you haven't created a password reset disk, see this article by Daniel Petri from MCSEworld.
Mitch Tulloch is the author of Windows 2000 Administration in a Nutshell, Windows Server 2003 in a Nutshell, and Windows Server Hacks.
Return to WindowsDevCenter.com.
Copyright © 2009 O'Reilly Media, Inc.