SEARCH

How-To Geek

Change or Reset Windows Password from a Ubuntu Live CD

If you can’t log in even after trying your twelve passwords, or you’ve inherited a computer complete with password-protected profiles, worry not – you don’t have to do a fresh install of Windows. We’ll show you how to change or reset your Windows password from a Ubuntu Live CD.

This method works for all of the NT-based version of Windows – anything from Windows 2000 and later, basically. And yes, that includes Windows 7.

Note: If you have files on your hard disk encrypted using built-in Windows encryption, they may not be available after changing the Windows password using this method. Exercise caution if you have important encrypted files.

You’ll need a Ubuntu 9.10 Live CD, or a bootable Ubuntu 9.10 Flash Drive. If you don’t have one, or have forgotten how to boot from the flash drive, check out our article on creating a bootable Ubuntu 9.10 flash drive.

The program that lets us manipulate Windows passwords is called chntpw. The steps to install it are different in 32-bit and 64-bit versions of Ubuntu.

Installation: 32-bit

Open up Synaptic Package Manager by clicking on System at the top of the screen, expanding the Administration section, and clicking on Synaptic Package Manager.

sshot-1

chntpw is found in the universe repository. Repositories are a way for Ubuntu to group software together so that users are able to choose if they want to use only completely open source software maintained by Ubuntu developers, or branch out and use software with different licenses and maintainers.

To enable software from the universe repository, click on Settings > Repositories in the Synaptic window.

sshot-2

Add a checkmark beside the box labeled “Community-maintained Open Source software (universe)” and then click close.

sshot-3

When you change the repositories you are selecting software from, you have to reload the list of available software. In the main Synaptic window, click on the Reload button.

sshot-4

The software lists will be downloaded.

sshot-5

Once downloaded, Synaptic must rebuild its search index. The label over the text field by the Search button will read “Rebuilding search index.” When it reads “Quick search,” type chntpw in the text field. The package will show up in the list.

sshot-6

Click on the checkbox near the chntpw name. Click on Mark for Installation.

sshot-7

chntpw won’t actually be installed until you apply the changes you’ve made, so click on the Apply button in the Synaptic window now.

sshot-8

You will be prompted to accept the changes. Click Apply.

sshot-9

The changes should be applied quickly. When they’re done, click Close.

sshot-10

chntpw is now installed! You can close Synaptic Package Manager. Skip to the section titled Using chntpw to reset your password.

Installation: 64-bit

The version of chntpw available in Ubuntu’s universe repository will not work properly on a 64-bit machine. Fortunately, a patched version exists in Debian’s Unstable branch, so let’s download it from there and install it manually.

Open Firefox. Whether it’s your preferred browser or not, it’s very readily accessible in the Ubuntu Live CD environment, so it will be the easiest to use. There’s a shortcut to Firefox in the top panel.

sshot-24

Navigate to http://packages.debian.org/sid/amd64/chntpw/download and download the latest version of chntpw for 64-bit machines.

Note: In most cases it would be best to add the Debian Unstable branch to a package manager, but since the Live CD environment will revert to its original state once you reboot, it’ll be faster to just download the .deb file.

sshot-17

Save the .deb file to the default location.

sshot-18

You can close Firefox if desired. Open a terminal window by clicking on Applications at the top-left of the screen, expanding the Accessories folder, and clicking on Terminal.

sshot-14

In the terminal window, enter the following text, hitting enter after each line:

cd Downloads
sudo dpkg –i chntpw*

sshot-19

chntpw will now be installed.

Using chntpw to reset your password

Before running chntpw, you will have to mount the hard drive that contains your Windows installation. In most cases, Ubuntu 9.10 makes this simple.

Click on Places at the top-left of the screen. If your Windows drive is easily identifiable – usually by its size – then left click on it.

sshot-11

If it is not obvious, then click on Computer and check out each hard drive until you find the correct one.

sshot-12

The correct hard drive will have the WINDOWS folder in it. When you find it, make a note of the drive’s label that appears in the menu bar of the file browser.

sshot-13

If you don’t already have one open, start a terminal window by going to Applications > Accessories > Terminal.

sshot-14

In the terminal window, enter the commands

cd /media
ls

pressing enter after each line. You should see one or more strings of text appear; one of those strings should correspond with the string that appeared in the title bar of the file browser earlier.

Change to that directory by entering the command

cd <hard drive label>

Since the hard drive label will be very annoying to type in, you can use a shortcut by typing in the first few letters or numbers of the drive label (capitalization matters) and pressing the Tab key. It will automatically complete the rest of the string (if those first few letters or numbers are unique).

sshot-15

We want to switch to a certain Windows directory. Enter the command:

cd WINDOWS/system32/config/

Again, you can use tab-completion to speed up entering this command.

sshot-16

To change or reset the administrator password, enter:

sudo chntpw SAM

SAM is the file that contains your Windows registry. You will see some text appear, including a list of all of the users on your system.

sshot-20

At the bottom of the terminal window, you should see a prompt that begins with “User Edit Menu:” and offers four choices. We recommend that you clear the password to blank (you can always set a new password in Windows once you log in). To do this, enter “1” and then “y” to confirm.

sshot-21

If you would like to change the password instead, enter “2”, then your desired password, and finally “y” to confirm.

sshot-25

If you would like to reset or change the password of a user other than the administrator, enter:

sudo chntpw –u <username> SAM

sshot-22

From here, you can follow the same steps as before: enter “1” to reset the password to blank, or “2” to change it to a value you provide.

sshot-23

And that’s it!

Conclusion

chntpw is a very useful utility provided for free by the open source community. It may make you think twice about how secure the Windows login system is, but knowing how to use chntpw can save your tail if your memory fails you two or eight times!

Trevor is our resident Linux geek, but always keeps his eyes open for neat Windows tricks too.

  • Published 04/5/10

Comments (67)

  1. TheFu

    The instructions on this page show where using a shell would have really simplified the installation instructions by avoiding a GUI completely. 8 pgs would be just 4 typed commands (or copied/pasted).

    On my x64 Ubuntu install, the package name was the same too, chntpw, but I didn’t actually install it and verify it worked.

  2. Trevor Bekolay

    @TheFu

    If you install the package on your x64 Ubuntu install, you’ll find that it won’t work. It will give you an error when you run chntpw on SAM.

    While it is true that there are command-line analogues to the GUI stuff that I show with Synaptic, my intention isn’t just to make a shell script that will do the necessary commands, it’s to show easy-to-remember techniques that will generalize to other problems.

    I could show the deb command that adds the universe repository, but there’s no way anyone would remember how to do that without referring back to this article (having used Linux for many years, I still have to look up proper syntax all the time). The GUI method, using Synaptic, is something that people at least have a shot at remembering and being able to use in the future when some website says “make sure you have the multiverse repository enabled.”

  3. Grant

    As far as I know, though, there is one thing to be cautious of. If you have encrypted files using the built in Windows encryption (not True Crypt or anything) may not be accessible if the Windows password is changed from outside of Windows. At that point, you may need to use some rainbow tables and just find out the old password.

  4. Trevor Bekolay

    @Grant

    Good point, thanks. I’ll add a note to the article.

  5. Zain

    OMG! I thought that Ubuntu is easier … but thanks to this article for saving me from wasting my hard drive’s space in installing this crappy piece of OS where you have to spend hours and performs those hundred steps to reset a password :p

  6. pb2004

    “It may make you think twice about how secure the Windows login system is.”? In Linux to reset root password you need only a text editor (e.g. gedit) to edit /etc/shadow. It will force you to think twice how secure is the system login on Linux distributions. ;-)

  7. Trevor Bekolay

    @Zain

    These steps are to reset a Windows password from Ubuntu. Resetting a Ubuntu password from Ubuntu is a one-word command (passwd). Resetting a Ubuntu password from Windows is much more complicated than what we show in this article.

    @pb2004

    Yeah, that’s a good point — really, you only need to edit /etc/passwd. With physical access, anything unencrypted is accessible through some means.

  8. Dale Harrington

    Thanks for this article. I’m not a Linux user, but it appears this would be helpful in some situations. I do have one dumb question though–and if it is too “noob” send me to the appropriate group–after I mount my HDD and use the terminal pgm, I’ve hit a snag. I can get to the HDD okay and I can surf it in the Ubuntu browser, but I can not change directories beyond the root in Terminal. Do I need to get some lessons in Ubuntu?
    Dale

  9. Trevor Bekolay

    @Dale Harrington

    If you’re in the terminal window and you type in, exactly:
    cd /media

    and hit enter, does the ubuntu prompt change as in this screenshot?

    In my experience with Linux beginners, many forget the “cd” at the start of that command. Also remember the “/” before “media”. “cd” is the command to Change Directories (hence “cd”).

    A great thing to print out and keep by you while you’re beginning in Linux is a cheat sheet such as this one. It can take some time to get used to, but the command line isn’t as bad as it seems if you have those basic commands down!

  10. whiplash55

    I use TRK or Trinity Rescue Kit for a number of tasks including resetting the password for admins.

  11. Dale Harrington

    Trevor,
    Thanks for the tips. I feel really STOOPID!!!! I guess i was having a DOS flashback since I wasn’t paying attention to capital letters at first. Then when I realized that dumb mistake and restarted the Terminal session, I forgot to reissue the cd /media and ls commands. DUH!!!
    Thanks again, it works great.
    Now if I could figure out to actually install chntpw to the flash drive, I wouldn’t have to redo everything each time I boot to the USB drive.
    Any thoughts?

    Dale

  12. Trevor Bekolay

    @Dale Harrington

    Ah, yeah, Ubuntu is case-sensitive, which I wasn’t used to at first either!

    There is a way to have the session persist on the flash drive, though I haven’t fully investigated that yet. Once I have, though, I plan to make a full article out of it, so keep checking back!

  13. pb2004

    @Trevor Bekolay
    Password hash is stored in /etc/shadow. /etc/passwd is only for compatibility and typically shows a character such as ‘*’, or ‘x’ in the password field for each user instead of the hashed password.

  14. Trevor Bekolay

    @pb2004

    Right, but if you remove the * or x from the password part of the string, you can log in without a password, can’t you? I mean, this might all be implementation specific anyway.

  15. N

    What does the password reset to? I followed the steps above and got the same results, but my admin account still has a password, I tried entering nothing and it still doesn’t login…

  16. Avinash

    Good Article!
    There is an easily available tool which resets Windows user accounts passwords (including Administrator) without all this procedure – Offline NT Password Recovery

  17. Trevor Bekolay

    @Avinash

    Actually, the Offline NT Password Recovery is the exact same program! It’s a minimalist version of Linux that has only the packages needed to boot up and read a Windows hard drive, and includes a script to make the process of using chntpw easier. But the program that actually does the changes is the same. Offline NT Password Recovery is much easier to use though, since it’s designed for that one single purpose.

  18. N

    Nevermind, I accidently reset the password of the win7 default admin acount instead…

  19. Assassin

    It’s a good article. What if i wanted to include chntpw file as it has to downloaded from the net. Is there a way to inlcude it CD.

  20. M Henri Day

    I attempted to use the procedure described above to recover – or more accurately, delete – a 32-bit Win 7 admin password, which is preventing me from logging in, from my 64-bit Ubuntu Lucid OS on the same computer. Everything worked more or less fine until, after cd-ing to /media/E8D41C74D41C46EA/Windows/System32/config/, I performed «sudo chntpw SAM», which gave the following result :

    chntpw version 0.99.5 070923 (decade), (c) Petter N Hagen
    openHive(SAM): File does not seem to be a registry hive!
    Simple registry editor. ? for help.
    get_abs_path: Not a ‘nk’ node!

    >

    What to try next ?…

    Henri

  21. Trevor Bekolay

    @M Henri Day

    Are you using the version downloaded from the Debian site? (here)

    The package in Ubuntu’s repository doesn’t work properly on 64-bit versions of Ubuntu. Try installing the version from the Debian site and report back!

  22. M Henri Day

    Thanks, Trevor, for commenting on my mishap ! As a matter of fact, before reading your comment, I realised that I had ignored you warning with regard to 64-bit boxes, so I proceed to the Debian site and downloaded and installed chntpw_0.99.6-2_amd64.deb to replace the 0.99.5-0+nmu1 version that is found in the repostories. After doing so, I was indeed able to follow the procedure for changing the Windows 7 password. But alas, no joy in Mudville – when I booted into Windows 7, I still could not open either the Administrator or the Guest account – I receive a message to the effect that my account has been disabled and am advised to consult my system administrator (your truly). For reference, I include here below the results of my attempts (repeated several times) to deal with this problem, I hope that they might provide a clue as to what I’m doing wrong and more importantly, how the error can be repaired :

    sudo chntpw SAM[sudo] password for mhenriday:
    chntpw version 0.99.6 080526 (sixtyfour), (c) Petter N Hagen
    Hive name (from header):
    ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c
    File size 28672 [7000] bytes, containing 6 pages (+ 1 headerpage)
    Used for data: 244/19592 blocks/bytes, unused: 15/4792 blocks/bytes.

    * SAM policy limits:
    Failed logins before lockout is: 0
    Minimum password length : 0
    Password history count : 0
    | RID -|———- Username ————| Admin? |- Lock? –|
    | 01f4 | Administrator | ADMIN | |
    | 01f5 | Guest | | dis/lock |

    ———————> SYSKEY CHECK Not Set (not installed, good!)
    SAM Account\F : 0 -> off
    SECURITY PolSecretEncryptionKey: -1 -> Not Set (OK if this is NT4)
    Syskey not installed!

    RID : 0500 [01f4]
    Username: Administrator
    fullname:
    comment : Built-in account for administering the computer/domain
    homedir :

    User is member of 1 groups:
    00000220 = Administrators (which has 1 members)

    Account bits: 0x0010 =
    [ ] Disabled | [ ] Homedir req. | [ ] Passwd not req. |
    [ ] Temp. duplicate | [X] Normal account | [ ] NMS account |
    [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act |
    [ ] Pwd don’t expir | [ ] Auto lockout | [ ] (unknown 0x08) |
    [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) |

    Failed login count: 0, while max tries is: 0
    Total login count: 257

    – – – – User Edit Menu:
    1 – Clear (blank) user password
    2 – Edit (set new) user password (careful with this on XP or Vista)
    3 – Promote user (make user an administrator)
    (4 – Unlock and enable user account) [seems unlocked already]
    q – Quit editing user, back to user select
    Select: [q] > 1

    Hives that have changed:
    # Name
    0
    Write hive files? (y/n) [n] : y
    0 – OK

    mhenriday ons 5 maj 2010 11.38.32 CEST
    [/media/E8D41C74D41C46EA/Windows/System32/config] sudo chntpw -u Guest SAM
    chntpw version 0.99.6 080526 (sixtyfour), (c) Petter N Hagen
    Hive name (from header):
    ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c
    File size 28672 [7000] bytes, containing 6 pages (+ 1 headerpage)
    Used for data: 244/19592 blocks/bytes, unused: 15/4792 blocks/bytes.

    * SAM policy limits:
    Failed logins before lockout is: 0
    Minimum password length : 0
    Password history count : 0
    | RID -|———- Username ————| Admin? |- Lock? –|
    | 01f4 | Administrator | ADMIN | |
    | 01f5 | Guest | | dis/lock |

    ———————> SYSKEY CHECK Not Set (not installed, good!)
    SAM Account\F : 0 -> off
    SECURITY PolSecretEncryptionKey: -1 -> Not Set (OK if this is NT4)
    Syskey not installed!

    RID : 0501 [01f5]
    Username: Guest
    fullname:
    comment : Built-in account for guest access to the computer/domain
    homedir :

    User is member of 1 groups:
    00000222 = Guests (which has 1 members)

    Account bits: 0x0215 =
    [X] Disabled | [ ] Homedir req. | [X] Passwd not req. |
    [ ] Temp. duplicate | [X] Normal account | [ ] NMS account |
    [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act |
    [X] Pwd don’t expir | [ ] Auto lockout | [ ] (unknown 0x08) |
    [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) |

    Failed login count: 0, while max tries is: 0
    Total login count: 0
    ** No NT MD4 hash found. This user probably has a BLANK password!
    ** No LANMAN hash found either. Sorry, cannot change. Try login with no password!

    – – – – User Edit Menu:
    1 – Clear (blank) user password
    2 – Edit (set new) user password (careful with this on XP or Vista)
    3 – Promote user (make user an administrator)
    4 – Unlock and enable user account [probably locked now]
    q – Quit editing user, back to user select
    Select: [q] > 1

    Hives that have changed:
    # Name
    0
    Write hive files? (y/n) [n] : y
    0 – OK

    Thanks for all your help !

    Henri

  23. Trevor Bekolay

    @M Henri Day

    Nothing’s jumping out at me as being done incorrectly. Have you tried editing the password and then trying to log in with that password?

  24. M Henri Day

    Thanks again, Trevor, for responding ! As a matter of fact, I also tried that, but no joy. What is worse is that I no longer have access to my 32-bit Windows Server 2008 system on the same machine (which sports two harddisks, one devoted to Ubuntu, one to Windows, with the latter being divided up between Windows Server 2008 and Windows 7). After attempting to blank/change the password on /dev/sda1, which is the boot sector on the Windows disk and contains the Windows 7 system, I find myself now locked out of the systems om both /dev/sda1 and /dev/sda2 ! Ain’t computers grand ?!!…

    Henri

  25. Trevor Bekolay

    @M Henri Day

    Huh, that’s strange, perhaps Win 7 and Server 2008 have some strange intertwinings that render this method ineffective (destructive, even). The hard disk isn’t encrypted, is it?

    As a last resort, I’d recommend burning a copy of the chntpw boot disk, found here. That page also has some more detailed instructions — hopefully that will work out!

  26. Dean

    Thanks for your guide. I ever used a similar password reset boot CD, it is called Windows Key Finder 1.3.

  27. Gary

    does this work on 10.04?

  28. Jeremy

    I usually use the Windows Password Reset Kit to reset Windows password, It worked great for me, with no reinstall and no data loss.

  29. Diana

    I have locked out of my computer for a while,and have tried everything i could do but failed.Until I found this great tool Windows Password Key 8.0 as recommend .It works great,Such a marvellous and useful tool

  30. Mmusi

    Hi,

    Please help me out, My user name is: MONOLITH 6
    There is a space between the name and the number, so if I want to reset this user account, what is the correct command. I have tried: sudo chntpw -u MONOLITH 6 SAM or sudo chntpw -u Monolith 6 SAM they all incorrect.

    Please help me out.

  31. Trevor Bekolay

    @ Mmusi

    Try sudo chntpw -u “MONOLITH 6″ SAM

    or

    sudo chntpw -u MONOLITH\ 6 SAM

  32. Jojo bokol

    where i can download, linux ubuntu third party software, boot from usb. And recover your data inside in the system. like in ERD commander Windows..

    what would i do?

    thnks

  33. www.allan5742.com

    this method is used for 1GB of RAM or more if not, pc will freeze and yo can do nothing. tested by me

  34. test.me

    @wiplash55 – The free distro of Trinity Rescue Kit is a no-brainer! Awesome! Works for Win7 & Server 2008 R2.
    These Ubuntu instructions are great, but Trinity Kit much easier and no instructions needed. Check it out people!

  35. rogetthat

    @www.allan5742.com – 1GB? Really? LMAO!

  36. vince086

    Nice article, I was trying this just to pass the time but had a snag.
    I don’t get a drive label so cant get any further.
    V

  37. Paul Pregnolato

    Very helpful and useful article – follow it the instructions closely and it works! I used an Ubuntu 10.10 LiveCD and it did the job perfectly :-)

  38. Ishara

    I have got everything ready, but I dont know how to connect to internet using Ubuntu Live (to download the packages from repositories.) Wireless is disabled and Ethernet connection wont be detected.Using AspireOne netbook.

  39. Andy

    How-To Geek you are my new hero. after trying many other things to fix a forgotten password on my niece’s Windows 7 computer (Offline NT Password & Registry Editor, Ophcrack, and a few others) to no avail I finally ran across this gem of an article and was able to access the Admin account after about 10 minutes worth of work. I’m starting to depend on my Linux Live USB more and more. Thank you.

  40. kp

    hey I’m stuck on one of the steps.
    I have the x64 version and after downloading the new chntpw I cannot install it with the steps they give as it states that libgcrypt is not up to date (apparently I have version 1.4.1 and they need 1.4.2)
    How do I go about this step?

    thank you very much to anyone who helps!

  41. starace

    I am a computer tech. I have a customer who has forgotten their windows 7 pw. I tried ubcd4windows ((usb flashdrive version) and it would not run. I tried my ubuntu flashdrive and installed chntpw. I ran chntpw and cleared the pw. everything looked successful. I restarted the pc and the computer still required a pw. i left the pw blank and hit enter. i guess chntpw didn’t clear the pw as i had thought. i tried it a few times without any luck. i have always been successful with ubcd4win or ubuntu. this time i am stumped.

  42. Josh

    These directions worked really well for me. I had to experiment with the location of system32 because “WINDOWS” wasn’t capitalized. So I had to make it work by going Windows/System32/config. I cleared the passwords out. But now there is a problem:

    The first thing I noticed is that when I looked at the “sam” list, which I was only able to access with lowercase letters. SAM would not work. But in the sam list, there were only 3 users. Administrator, Josh and Guest. But I believe there should have been another and I don’t understand why I don’t see it.

    At any rate, I cleared the administrator password and went to reboot, but when I arrive to my users, I see Josh and a new, blank user. If I click on the blank user box, I’m asked for both the username and password. I AM now able to pull up the built-in Administrator and get through without a password (which wasn’t possible before), but once I’m logged in, if I go to make a change I’m stilled told that I must enter the password to make changes to the computer. It asks me if I want to enter the password, but no longer provides a place for me to type one and only allows me to click “NO”.

    Has anyone ever seen this problem before? Please let me know if you have any idea what I should do from here. I don’t know how to get my user account information back instead of the new blank one and I’m still not getting around the password!

    Thanks!

  43. Matt

    Long time ago , I confronted with the similar problem. Finally , my friend Jane introduce the Windows Password Resetter 1.7. It help me access windows. It’s worth a try!

  44. preston

    When I type the command cd /media ls i get the result of Apt OSDisk

    when i try to cd /apt OSDisk I get the error message that I do not have permission.

    Any suggestions?

  45. preston

    nevermind, i had to run the terminal with Sudo Bash and then all commands worked

  46. karan

    i get an error can u help me “*****@ubuntu:/media/**********/Windows/System32/config$ sudo chntpw SAM
    chntpw version 0.99.6 080526 (sixtyfour), (c) Petter N Hagen
    openHive(SAM) failed: No such file or directory, trying read-only
    openHive(SAM) in fallback RO-mode failed: No such file or directory
    closing hive SAM”

  47. paul

    i’m trying to reset the password on a acer aspire one laptop.
    i tried the offline nt password… but it could not find the hdd it only found the flash drive ??

    so i tried the method you outline, but it can’t find the persons username
    it does say that other usernames are found
    Administraor
    nicola
    Guest

    i’ve tried reseting passwords for these users and then logging into windows and changing user at the login screen but still get password incorrect, even when i change the password.

    looks like i’ll have to reinstall windows and then search for the acer drivers.

    PS if you don’t have internet connection dl the chntpw file and install it from usb.

  48. paul

    it looks like a few people are having a problem reseting the password

    could it be that windows have upped their secruity?

  49. Redbach

    I guess so Paul, because I’ve followed all the steps above and everything went well except when I try to login into windows, it still requires a password ! :/

  50. Debbie

    I suppose you can use AD Password Reset 1.7 to reset lost or forgotten windows login password.

  51. Hoffman

    Thanks for providing this solution.

    When I looked at the registry through in the terminal window, all passwords were shown as *blank*…which means there is no password for those users. However, when I tried to log into windows, passwords are required…which I do not have because I had never set them up. Anyone knows what’s going on?

  52. passwordbuster

    Lost windows password,you can try windows password buster, It’s a fast, easy and efficient solution to recover your forgotten or lost Windows password.

  53. passwordbuster

    Thanks for providing this solution.

  54. Bob

    Good looking article, pity it doesn’t work.

  55. Davyboy

    Dude cheers for this guide!!

    I’ve been having a long list of issues with my rig, first my quad radiator developed a leak so I couldn’t use my system for close to two months, by which time when it came to fitting the new radiator I had completely forgotten my login password, and I tried a few different things to try gain access to my OS, like offline NT password and reg editor, and screwing around with regedit by loading up win 7 install disk and starting regedit from a command prompt, but nothing worked, I also tried this method several times too, first with 64bit ubuntu, but it just wouldn’t work for me at all, so I downloaded 32bit ubuntu and tried using chnptw from the repositories as shown in this guide but again it still wouldn’t work, and I was just in the process of making a bootable pendrive to put HDDErase onto so I could secure erase my SSD, when I decided to give this method one more attempt only this time using an older version of chnptw, and ‘bang’ it worked like a charm!!!!

    So glad that I didn’t decide to do a full format and reinstall, to the guy who commented above me saying it didn’t work, use 10.10 ubuntu 32bit and download chntpw_0.99.3-1_i386.deb instead of the one from synaptic package manager as shown in this guide, like I said i’ve spent all of last night and all of today and tonight trying loads of different methods, and doing what I said above worked first time.

    Thanks again for posting this mate.

  56. Akshay

    @Davyboy
    Well, I’ve tried many times and chntpw never worked! I just believe on it because it shows user names which proves that its not fraud! Now, you have just said you made it work. Can you provide me the chntpw_0.99.3.-1_i386 which you have found to be working. Did you have the same problem (password still there even after everything went well!) with repository (synaptic) version of chntpw? Please, help!

  57. Davyboy

    Hi mate, if you just google the version that I stated in my last post and you will find various sites that are hosting it.

    Failing that you could give me your email address and I will send the version I used so you can get it working too, like I said I tried various different things to try reset my login password as my rig sat for a couple of months not being used due to my watercooling radiator developing a puncture, and when I finally got the funds to buy a new rad and got my loop all plumbed back in and filled I booted the system up and got to the login screen only to find that I’d forgotten my pass, and I tried this method about 10 times but with the 64bit ubuntu live disk, and it looked like it was working but each time I booted into Windows it was still asking for my password, so I downloaded 32bit ubuntu and used chntpw from synaptic as stated on this guide, but again it failed miserably, even though it looked as though it had actually worked.

    I decided that it was time to secure erase my ssd and reinstall window 7, but I then thought that I would give it another try only this time searching the net for a different version of chntpw, and I came across the version I mentioned in above post, and I wasn’t really expecting it to work, but much to my surprise it worked perfectly first time!!!

    The options were kinda different from the version I got from synaptic package manager, but it worked like a charm.

    Let me know if you can’t find the version I posted above mate, and if you cant then just gimme your email addy or create a new one (just incase someone decides to send you loads of spam mail for posting your real email addy up here!) and I will send you it as I made sure to save a copy of it for myself incase any friends or relatives run into the same problem.

    There shouldn’t be any issues finding it via google though, infact I will post up the link to where I got it later on when I’m at home as I’m sending this from my iPhone.

    Good luck :)

  58. Paul

    Thought I finally had it, using a newer version of chntpw, but same thing everyone else above describes, where term says success after selecting option 1, reboot into windows, theres a new user with no name that requires a pw, and the orig admin acct still wont let me in with no password! going to try the older version chntpw_0.99.3-1_i386.deb mentioned above and report back.

  59. khashayar

    tnx a lot!

  60. LeRoy

    I just restored Windows 7 starter to a Toshiba netbook N305 from a WindowsImageBackup. The restore took me awhile since I did not make a system repair disk like I should have – long story! But got it done!! Got it all restored BUT could not for the life of me remember the original password for the user account that my son set it up with. Panic attack!! Then found this website!!! Wooohooo! Downloaded Ubuntu onto a live cd and followed your directions to a “T”…worked like a charm!!! Thanks a million!!! Linux rocks on things like this…even reformatted the drive before the backup using puppy linux (g-parted). My wife is loving her Windows 7 netbook back to its original state AND, YES I just made the system repair disk…and if I ever password protect it, will make that disk too! Again, thanks much for your superb directions and this website!

  61. mar

    this works on windows 7 ultimate

  62. felipe

    ubuntu@ubuntu:/media/F6B47633B475F709/Windows/System32/config$ sudo chntpw SAM
    chntpw version 0.99.6 080526 (sixtyfour), (c) Petter N Hagen
    Hive name (from header):
    ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c
    Page at 0x10000 is not ‘hbin’, assuming file contains garbage at end
    File size 262144 [40000] bytes, containing 7 pages (+ 1 headerpage)
    Used for data: 259/53392 blocks/bytes, unused: 18/7824 blocks/bytes.

    * SAM policy limits:
    Failed logins before lockout is: 0
    Minimum password length : 6
    Password history count : 6
    | RID -|———- Username ————| Admin? |- Lock? –|
    | 01f4 | Administrador | ADMIN | dis/lock |
    | 01f5 | Convidado | | dis/lock |
    | 03e8 | robsonf | ADMIN | dis/lock |

    ———————> SYSKEY CHECK Not Set (not installed, good!)
    SAM Account\F : 0 -> off
    SECURITY PolSecretEncryptionKey: -1 -> Not Set (OK if this is NT4)
    Syskey not installed!
    Cannot find value

    Hives that have changed:
    # Name
    None!

    ubuntu@ubuntu:/media/F6B47633B475F709/Windows/System32/config$

  63. jan

    Thx man, this saved my ass

  64. noname

    thanks for the gui and bypassing package manager

    other guides were confusing !

  65. JES

    Thanks, worked me at last. First when I was trying to install chntpw it threw an error.

    $ sudo apt-get install chntpw

    “unable to locate package unbuntu”

    Then I went to Synaptic Package > Settings > Repositories > checked every one of them. Tried the above command again and chntpw was installed. :-)

  66. durfi

    Hey guys!

    Thanks for all your replies mentioning the older version of chntpw (chntpw_0.99.3-1_i386.deb). The one from the ubuntu repo didn’t work for me, but this one just DID!

    Bye, durfi

  67. Dadang Sudirman

    how to make this chntpw to be one packet with my bootable ubuntu flash disk/CD?

Enter Your Email Here to Get Access for Free:

Go check your email!