Admin Access on any Windows 7 Machine

Discussion in 'Computer Tutorials' started by TheGeneralFilms, Sep 21, 2017.

  1. TheGeneralFilms
    OP

    TheGeneralFilms Advanced Member

    Newcomer
    89
    62
    Jul 23, 2015
    Canada
    My Computer
    This one's an oldie, and if you don't have access to the BIOS for some reason then this is perfect. It takes some time, but yeah.

    So the first thing you want to do is get the recovery options menu (see below)
    There's multiple ways of doing this, such as force shutting down your PC, pressing CTRL + ALT + DELETE until you get it, or holding down the F8 key during boot.

    [​IMG]

    However you manage to get it, you're gonna want to select "Launch Startup Repair" as shown above.

    Wait for it to "search for problems". This'll probably take awhile, so just give it a few minutes.If a popup that says "Do you want to restore your computer using System Restore" comes up, press CANCEL.

    Wait for the "Startup Repair cannot repair this computer automatically" popup to show. This is where the fun begins!

    Click "view problem details" and scroll to the bottom, where there'll be a link to a text file (should look like "X:\windows\blahblahblah"). Click on it and it'll open up notepad with some useless jabber. You can ignore all of this, it's not important.

    Now, go to "File > Open". Now go to the "Computer" tab and navigate to "C:\Windows\" and make sure that the file type is changed from ".txt" to "all files". Next, scroll down and locate "cmd.exe". This is the command prompt, and we need this to give ourselves admin access. Next, make a copy of it (right click > copy, CTRL + C, whatever.) and then right click and paste it. This will make "cmd.exe - Copy".

    Now, you're gonna want to find "sethc.exe". This is the program that executes the "Sticky Keys" popup (that annoying program that comes up when you press shift too many times). We're going to replace this with our copy of cmd.exe, so instead of the sticky keys popup, we'll get the Command Prompt. Neat, right? So all you need to do is rename "sethc.exe" to... anything that isn't "sethc.exe".

    Once that's all done, go back to the copy of cmd.exe you made. Rename it from "cmd.exe - Copy" to "sethc.exe" (make sure it's "sethc.exe", not "sethc.exe.exe"!)

    We're done here! Now close out of everything, click "don't send" and then "finish". Restart your machine into regular windows. If any error recovery prompt comes up, select "Start Windows Normally".

    Once you're at the login screen, don't log in. You're going to click shift until the Command Prompt window comes up. Success! If it doesn't come up, you did something wrong. Repeat the steps until you get it.

    Now, we enable the default "Administrator" account, giving us admin access. We can do this because at the login screen, we're actually using a user account called "SYSTEM" that has full privileges. This is what's used to log users in and some other stuff. (You can type "explorer.exe" into the command prompt and the start menu will show up. Neat!)

    Now, let's set a password for the administrator account. Type "net user Administrator *", and enter your desired password.

    Now, chances are if you try logging in with the Administrator account and its new password, it'll probably say "the account has been disabled", so we'll have to re-enable it. Bring up your cmd again, and continue.

    To activate it, type "net user Administrator /Active:yes". The account will be activated! You can verify by typing "net user Administrator".

    That's it! Now log in and do whatever you want to the computer. I take no responsibility for any damage you do to school/work/public property! Have fun!

    TL;DR?
    No. Read it.


    **EDIT**
    If anyone wants I'll make a video on it
     
    Last edited by TheGeneralFilms, Sep 21, 2017
  2. richrard

    richrard Newbie

    Newcomer
    5
    3
    Dec 15, 2013
    United States
    I do the same thing with utilman.exe instead of sethc.exe, which makes the ease of access button before sign-in launch cmd. I do local computer repair and it comes in handy. Can also be done from installation DVD as long as you aren't locked out of boot options, but sometimes the recovery partition is missing or not registered properly. Works in Vista-Win10
     
    Last edited by richrard, Sep 21, 2017
    gudenau and TheGeneralFilms like this.
  3. TheGeneralFilms
    OP

    TheGeneralFilms Advanced Member

    Newcomer
    89
    62
    Jul 23, 2015
    Canada
    My Computer
    Thanks for confirming that, I've only actually tested it in Windows 7. Wasn't quite sure.
     
  4. RandomUser

    RandomUser What has gotten into you Rosie?

    Member
    602
    223
    May 9, 2010
    United States
    If you want to access administrator account even faster, you can use Kon-Boot. Bypasses all Windows passwords and can log you into Admin.
    Actually this is a nice find and a free way to access administrator account.
     
  5. TheGeneralFilms
    OP

    TheGeneralFilms Advanced Member

    Newcomer
    89
    62
    Jul 23, 2015
    Canada
    My Computer
    From what I see here you need to pay for this, and there's some much better free alternatives. However, this guide assumes that the BIOS is locked down (meaning you can't change the boot settings) as many schools / corporations do lock down their machines with BIOS passwords. This doesn't require anything special, just some time.
     
  6. Seliph

    Seliph Scion of Light/Orphan

    Member
    666
    460
    Jul 11, 2016
    United States
    Somewhere in Jugdral
    Heh, I remember I did this once when I was 11 because my dad would make it so I was force logged out past 9 pm and all programs I downloaded had to go through him because it wouldn't let me download anything without a password.
    I'm pretty sure this method doesn't work on Hp computers because when you get to the repair part or something, hp redirects you to a custom repair program made by Hp and you need the default repair program for this method to work.
     
    Last edited by Seliph, Sep 22, 2017
  7. RandomUser

    RandomUser What has gotten into you Rosie?

    Member
    602
    223
    May 9, 2010
    United States
    I was mentioning your method is a nice find, not Kon-Boot, sorry for the confusion.
    Also who said you need to pay for Kon-Boot, you can download it for free, it just takes some time and searching:tpi:. Not exactly legal though.
     
  8. richrard

    richrard Newbie

    Newcomer
    5
    3
    Dec 15, 2013
    United States
    That's when booting from an installation DVD or USB works better. Shift + F10 to bring up a cmd window, then you can just find the partition with your install, use the 'cd' command to navigate to Windows\System32\ and copy cmd.exe over utilman.exe or sethc.exe. I usually just do this first, because sometimes there is an alternative recovery or no recovery partition set at all.
     
  9. hobbledehoy899

    hobbledehoy899 Conniption Master

    Member
    2,767
    4,571
    Nov 13, 2015
    United States
    Kernel Version: Linux 4.14.6-1-zen
    BIOS passwords are the best!
     
  10. DaniPoo

    DaniPoo GBAtemp Fan

    Member
    338
    76
    Jan 2, 2013
    I assume that this will work fine even on Bitlocker protected PC's (and such) with password locked Bios?
     
  11. TheGeneralFilms
    OP

    TheGeneralFilms Advanced Member

    Newcomer
    89
    62
    Jul 23, 2015
    Canada
    My Computer
    Yes, it should work.

    That might work. I used this method because it requires no extra setup or preparation.

    Oh god, tell me about it. This company recycled a whole bunch of expensive laptops and I grabbed one because I could use it for work (6GB of RAM and an i5, who wouldn't?) But they had locked down the BIOS.
    Luckily, I came across http://bios-pw.org, a site where they have all of the master BIOS keys for laptops stored. All you have to do is enter the serial number and you're in!

    You can always trust the Chinese for quality bootlegs ;)

    That's quite interesting, I've never seen that before.
     
  12. DaniPoo

    DaniPoo GBAtemp Fan

    Member
    338
    76
    Jan 2, 2013
    Startup repair is available on HP PC's as well, tho HP has some kind of boot software too for hardware diagnostics. Im working in an IT department for a company that mainly uses HP branded PC's, so I have seen both.
     
    Seliph likes this.
  13. TheGeneralFilms
    OP

    TheGeneralFilms Advanced Member

    Newcomer
    89
    62
    Jul 23, 2015
    Canada
    My Computer
    very interesting!
     
  14. DaniPoo

    DaniPoo GBAtemp Fan

    Member
    338
    76
    Jan 2, 2013
    https://support.hp.com/us-en/document/c01443317

    Tho this is part of bios or UEFI so it runs before booting the hardrive and should not affect Windows in any way.
    Is see no reason why this trick should not work on an HP PC, It should work on any PC that has access to startup repair right
     
    Last edited by DaniPoo, Sep 22, 2017
    TheGeneralFilms likes this.
  15. TheGeneralFilms
    OP

    TheGeneralFilms Advanced Member

    Newcomer
    89
    62
    Jul 23, 2015
    Canada
    My Computer
    Thank you for sharing!
     
  16. VinLark

    VinLark This machine kills bourgeois sentimentality.

    Member
    4,193
    5,050
    Jun 11, 2016
    Trinidad and Tobago
    Psychosystem Denomination
    I always use a Ubuntu USB and chntpwn. Assuming the BIOS isn't locked.
     
  17. MarioMasta64

    MarioMasta64 hi. i make batch stuff and portable shiz

    Member
    1,963
    415
    Dec 21, 2016
    United States
    here i thought everyone knew how to do this, btw a similar bug still exists in windows 10 however it doesnt work with a m$ft linked account
     
  18. TheGeneralFilms
    OP

    TheGeneralFilms Advanced Member

    Newcomer
    89
    62
    Jul 23, 2015
    Canada
    My Computer
    Ahh yes, USB booting Linux is a fun option
     
    felix.200 likes this.
  19. Seliph

    Seliph Scion of Light/Orphan

    Member
    666
    460
    Jul 11, 2016
    United States
    Somewhere in Jugdral
    Oh, I see. Guess I didn't try hard enough when I did it on the HP.
     
  20. Luglige

    Luglige hiatus

    Member
    1,411
    1,563
    Jan 24, 2016
    Antarctica
    under your bed