I typically use a Linux rescue CD for this purpose. My preference is the, which is a standard part of my toolbox. PLD includes the chntpw - NT SAM password recovery utility, which allows blanking or modification of the Windows password file. Assuming some Linux knowledge, this process works reliably. More details at:. Download the ISO image to your vCenter host or client system.
Boot the VM off of the image (Modify BIOS to boot from CD first, if necessary). Once the Linux rescue boots, the Windows drives are unmounted. Fdisk -l will show the drive partitions. Let's say that the C drive is listed as /dev/sda2 (although, this may be different on your system).
You can mount the drive (C:) to the Linux mountpoint, /mnt using the command: mount.ntfs-3g /dev/sda2 /mnt. Navigate to the directory containing the SAM file, cd /mnt/windows/system32/config or /mnt/winnt/system32/config.
Run chntpw -h to list options. The default is chntpw SAM, which will provide menu options to change the Administrator user's password. I usually blank it and reassign upon reboot. You can also assign a new password at this point. Change out of the Windows filesystem directory using cd and unmount the partition, umount /mnt.
Reboot and the system should come up.
Reset Windows 2003 password with the burned CD/CVD or USB drive. Reboot the locked PC, and select your target Windows system, then click Next.Jan 29, 2010 OP here: 1. Windows XP Privilege Escalation Exploit.