I have a lab setup with a few Windows machines, including a domain controller, which I can never seem to remember the password for.  After reading over some different options, this is by far the most easiest method to reset the Administrator password and does not require any third party software – outside of a Windows Server 2008 install disk.

First shut the running machine down, luckily my lab was running in a virtual environment and had the vmware tools installed on the guest machine that needed the password reset on.  I opened a console window to the vm and in the viewer selected VM from the menu bar, Power, then Restart Guest (Ctrl+R).  Obviously if this is a physical machine or a virtual without the tools installed, you may have to shut it down / power off not so gracefully.  However, at this point – if you can’t login to the machine – what else can you do?

Make sure your boot order is setup properly in the BIOS, so that the machine will attempt to boot from CD/DVD first, before the hard drive.  Once this is correctly set, be sure to press a key for booting to the DVD, while the message is shown telling you to do so.

Once booted to the DVD, the following screenshot will be the first thing you see.  Select the desired language and click on Next.

^[1]

The following screen will appear next, which typically you would use the Install now on.  However, there are a couple more options on this screen.  In the lower left hand corner, click on the Repair your computer.

^[1]

The following screen reflects the next window you will see, which is a question regarding the Windows installation to be repaired.  As you can see below, I have the Windows installation location selected (note it tells you what drive letter will be used during this repair session – D: in this/most cases).  Click on Next.

^[2]

The following window will then appear, select the Command Prompt link.

^[3]

After selecting a command prompt link, a cmd window will open like the one below:

^[4]

Perform the following steps:

- Change to the assigned drive letter Windows is installed on.

- Change to the \Windows\System32 directory.

- Move the existing file utilman.exe to a temporary name, such as utilman.exe.bak

- Copy the command interpretor cmd.exe to utilman.exe

The previously described operations are reflected in the following screenshot:

Exit the command Window and click on the Restart button

^[5]

After restarting, allow the machine to boot normally from the hard drive.  The following screenshot is the normal Windows login screen you will see.  Press the key combination Windows key + U

^[6]

After pressing the Windows+U keys, a command window will appear like what is in the following screenshot:

^[7]

The next step is your normal command line password change commands.  If your not aware of which username you should be changing, use net group “Domain Admins” to determine the userid that needs resetting.

^[8]

The user Administrator is what I need reset, so use the following command net user Administrator <A secure password> like what is shown in the following screenshot:

^[9]

At this point, you have successfully reset the Administrator password!  However, there is one more task that needs to be performed.  Shut the machine down and repeat the steps with the Windows 2008 Server install DVD up to the point where you have a command window opened.  Copy the backup file utilman.exe.bak over the existing utilman.exe file (which at this point is a renamed copy of cmd.exe).  Reboot the machine back to the OS installed on the hard drive.

Note:  Failure to perform this step will keep the what is now a potential security hole open on your machine.  So it is important to return the utilman.exe file back to it’s original state.

^[10]