How to find out the password for a computer in Windows 7 if it is already turned on? What to do if you have lost your Windows administrator password.

We need interesting and useful articles to publish on our forum. We have a proofreader and an editor, so you don’t have to worry about spelling and text formatting. We will check everything and arrange it beautifully.

This article will describe how to find out the password for Windows (any version), NOT reset, NOT change, but FIND OUT.

Retreat first

Resetting a password or changing it in a Windows system is easy - schoolchildren have already made their own hundreds of videos on how to do this.

Advanced schoolchildren use the PRO version of the ElcomSoft System Recovery program, which “cracks a password in half a minute” (in fact, it searches the dictionary for the most popular passwords, compares them with previously calculated hashes, and, if the student has set a password something like “1”, “1111”, “123”, “admin”, “password”, then the program displays it).

Advanced users make videos on how to reset a password using Kali Linux. Moreover, Kali Linux is used for 1) mounting a disk with Windows OS, 2) renaming one file to launch the command line... I think in their free time these people crack nuts with iPhones.

Actually, I'm kidding. In 99.99% of cases, this is exactly what is needed - to reset the password of a student or accountant who for some reason set it and conveniently forgot it.

If this is exactly what you need, then boot from any Live disk (it could be Linux - whatever). In the catalog C:WindowsSystem32 rename the file cmd.exe V sethc.exe or in osk.exe. It is clear that you need to make a backup of the sethc.exe (or osk.exe) file, and copy the cmd.exe file with a new name.

If you renamed the file to sethc.exe, then the next time you boot Windows, when you are asked for a password, press the SHIFT button five times, and if in osk.exe, then call up the on-screen keyboard. In both cases, you will see a command line (cmd.exe) in which you need to type:

net user username *

Those. if the username is admin, then you need to type:

And now I will shoot my video.

I'm kidding again.

Finding out the Windows password using Kali Linux

Theory: Where does Windows store its passwords?

Windows places passwords in the registry file SAM(System Account Management) (account management system). Except when Active Directory is used. Active Directoryis a separate authentication system that places passwords in an LDAP database. The SAM file is in C: System32config (C: sys32config).

The SAM file stores passwords as hashes, using LM and NTLM hashes to add security to the file being protected.

Hence an important note: obtaining a password is probabilistic in nature. If we manage to decrypt the hash, then the password is ours, but if not, then not...

The SAM file cannot be moved or copied while Windows is running. The SAM file can be dumped (dumped), and password hashes obtained from it can be subject to brute force for offline hacking. A hacker can also obtain the SAM file by booting from a different OS and mounting C:. You can boot from a Linux distribution such as Kali, or boot from a Live disk.

One common place to look for a SAM file is C: repair. By default, a backup of the SAM file is created and is usually not deleted by the system administrator. The backup of this file is not protected, but is compressed, which means you need to unzip it to get the hash file. To do this you can use the utility expand. The command looks like Expand. Here's an example of expanding a SAM file into a file called uncompressedSAM.

C:> expand SAM uncompressedSAM

To improve protection against offline hacking, Microsoft Windows 2000 and later versions include a utility SYSKEY. The SYSKEY utility encrypts the hashed passwords in the SAM file using a 128-bit encryption key, which is different for each Windows installation.

An attacker with physical access to a Windows system can obtain the SYSKEY (also called the boot key) using the following steps:

We present to your attention a new course from the team The Codeby- "Penetration testing of Web Applications from scratch." General theory, working environment preparation, passive fuzzing and fingerprinting, Active fuzzing, Vulnerabilities, Post-exploitation, Tools, Social Engeneering and much more.

Boot from another OS (for example, Kali).
Steal SAM and SYSTEM hives ( C: System32config (C: sys32config)).
Recover boot key from SYSTEM hives using bkreg or bkhive.
Dump password hashes.
Hack them offline using a tool such as John the Ripper.

One more important note. Each time you access files in Windows, the MAC(modification, access and change), which guarantees your presence. To avoid leaving behind forensic evidence, it is recommended to copy the target system (make a disk image) before launching attacks.

Mounting Windows

There are tools available to capture Windows SAM files and SYSKEY key file. One method of capturing these files is to mount the target Windows system so that other tools have access to these files while Microsoft Windows is not running.

The first step is to use the fdisk -l command to identify your partitions. You must identify Windows and the partition type. The fdisk output shows an NTFS partition, like this:

Device Boot Start End Blocks Id System

/dev/hdb1* 1 2432 19535008+ 86 NTFS

/dev/hdb2 2433 2554 979965 82 Linux swap/Solaris

/dev/hdb3 2555 6202 29302560 83 Linux

Create a mount point using the following command mkdir /mnt/windows .

Mount the Windows system partition using the command as shown in the following example:

mount -t /mnt/windows

Now that the target Windows system is mounted, you can copy the SAM and SYSTEM files to your attack directory with the following command:

cp SAM SYSTEM /pentest/passwords/AttackDirectory

Tools are available to dump the SAM file. PwDumpand Cain, Abel And samdump- these are just a few examples.

Please note that you need to recover both boot key and SAM files. The boot key file is used to access the SAM file. Tools used to access the SAM file will require a boot key file.

bkreg And bkhiveare- popular tools that will help you get the key loader file, as shown in the following screenshot:

How to protect yourself from theft of your Windows login password:

First of all, you don't need to rely on this password. This password will not save you even from your school-aged son. This password will not help you protect your data and is also useless if your computer is stolen. (The situation with the BIOS password is about the same - it does not provide any real protection, and from time to time it ruins the lives of accountants and people with poor memory).
If it is important for you to limit access to data or to the entire system, use encryption programs such as (but if in this case you forget the password, the data will be irretrievably lost).
To prevent schoolchildren from deciphering your password for logging into Windows, come up with a complex, long password with different registers, numbers and letters (including Russian), etc. But I repeat once again - this password does not protect anything.

In everyday life, there are often cases when you urgently need to use a device that has a key on it, but you don’t know it. Everyone knows that you can’t hack other people’s computers, but situations are also possible when you forgot the key to your own computer. Read where to safely store passwords. For example, if it is not used for a long time. Don't be upset, because in most cases this problem can be dealt with. Moreover, you don’t have to be a professional in computer technology to do this.

First of all, you need to understand what a computer key is. In simple terms, a password is a set of characters (letters, signs, numbers) needed to log into the system as a specific user. As a rule, the owner of the device comes up with it himself. But if the computer you are working on is a corporate one, then the administrator will most often give you the password.

Is it possible to reset a user's key?

This is only possible when you are in an administrator account and have not yet logged out of the system. Then you can simply change the key without knowing the old one. To do this, go to the “Settings” menu through the “Start” button, select “User Accounts”, then click “Reset Password”. Write a new one in the line that opens.

Where is the computer key kept?

The operating system registry acts as a repository for all device data. When you turn on the computer, it checks the characters entered and stored in the registry. If they do not match, you will be asked to enter them again.

How to remove user password?

If you are a regular user (not an administrator) and accidentally forgot the code. To do this, you just need to enter the software in safe mode by pressing the F8 key. How to enter safe mode in new versions of Windows was written in this article. After that, log in as an Administrator by entering his name and password. Open, find “Accounts” through the “Control Panel”. Among the many, find the account you need and edit (via the “Withdraw” or “Delete password” items). This method will be relevant if you know the Administrator’s details; if you don’t have them, then read below.

How to hack windows 7 administrator password?

For Windows 7. When you turn on the computer, press F8 to open the following window:

Select with command line support.

After opening the command window, enter:

copy from:\windows\System32\sethc.exe from:\temp

Thus, we copy the sethc file, where the administrator password is stored, so as not to lose it, because it will be replaced.

Then we write:

copy c:\windows\System32\cmd.exe c:\windows\System32\sethc.exe

With this command we replaced the password file with the command line.

Exit cmd:

We boot the computer in normal mode.

After loading, press Shift 5 times. cmd will open. Enter:

We will see the name of the main admin. If the administrator account is disabled, you can enable it:

net user admin name /active:yes

If the name consists of two or more separate words, they must be enclosed in quotation marks.

Set a new key for the administrator:

net user admin username password

After this, restart the computer and enter the new key.

After a successful procedure, you need to return the sticky keys file to its place:

copy from:\temp\sethc.exe from:\windows\system32\sethc.exe

Resetting your password on Windows 8 and 10

After loading, select the keyboard layout and follow the path “Diagnostics” - “Advanced options” - “Command line”.

Then follow all the steps as in the case of Windows 7, which is described just above. The only difference is that instead of sethc you need to write utilman.

How else can you reset your password?

So, we can conclude that you can reset your password in various ways, depending on the access you have to the device. If you are its Administrator, then this will be much easier to do than for an ordinary user.

Thus, it is almost impossible to obtain the key; you can only reset it and replace it with a new one. However, nowadays almost everything is available. There are special spy programs for this. But using them is risky, as they can harm your computer: destroy some files, introduce malicious spyware.

To avoid all of the above problems, it is enough to simply create complex and at the same time memorable passwords.

But then a problem happened - the owner forgot the administrator’s access code and when he tried to log in, he saw a message about the incorrectly entered password and the impossibility of logging into the system. The situation is further aggravated by the fact that Windows stores all passwords in a securely protected partition on the hard drive using the SAM system. For security reasons, accessing it and finding out the password is not as easy as it might seem at first glance. On the one hand, this will protect you from third-party interference, but, on the other hand, it greatly ruins your life if you forget the access combination. Users of Windows 7 suffer the most, since this version of the OS only offers work with a local account, unlike the newer Windows 8, 8.1 and 10. Here the user can attach a Microsoft account to the computer and, in case of a forgotten password, can reset it via website from any device. PC owners on seven can only remove the administrator password.

Fortunately, everything is not as scary as it might seem at first glance. If you follow our detailed instructions on how to reset the Windows 7 administrator password when using a local account, as well as how to find out the password, you can easily solve your problem in a short time without outside help. So let's get started.

Method 1. Using an installation disk or recovery image

To do this, you will need a boot disk or flash drive with Windows, or a previously created recovery disk (this can also be a flash drive). If you may not be able to figure out the second one, since you are unlikely to constantly create fresh recovery disks, then the installation image can be downloaded from a large number of sites.

Insert the disk or flash drive into the PC, and in the BIOS, mark the media as a priority when booting. This is necessary so that loading occurs from external media, and not from the built-in hard drive.
Depending on the version of Windows, click Diagnostics - Advanced options - Command Prompt or System Restore - Next - Command Prompt.
When the command prompt opens, add regedit and press Enter.
Click on the HKEY_LOCAL_MACHINE section to highlight it, then click File - Load Hive.
In the window that opens, go to C:\Windows\System32\config (if the system is installed in a different partition, the address will be slightly different) and open the System.
Name the loading partition any name, for example, 555.
In the registry editor, look in the HKEY_LOCAL_MACHINE\555\Setup section and find the CmdLine and SetupType parameters there. Double-click on each of them and change the indicators to the following:
- CmdLine - cmd.exe.
- SetupType - 0 change to 2.
Select the 555 partition you created, then click File - Unload Hive.
Take out the flash drive or disk, close all active utilities, select “Reboot” in the main window of the recovery wizard.

After restarting, when you log in, the command line will be expanded. With its help we will perform further operations.

Password reset

To reset your password, use this command:

net user login password

This command is relevant if you remember the exact spelling of the username. If you forgot, type the command net user, after which all accounts saved on the PC will be displayed.

Create a new account

If you do not have any administrator account installed, you will need to create one by entering a few commands. To do this, enter them one by one on the command line:

net user login password /add

net localgroup Administrators login /add

net localgroup Users login /delete

The first command first creates a new account, then assigns it to the administrators group, and then removes it from the users group. After applying all the commands, close the Command Prompt.

By creating a new account with a new password, you will be able to log into Windows without any problems.

Note! You won’t be able to find out your password this way, you can only reset it!

Method 2. Using third-party utilities

Offline NT Password Editor

If the first method involved using standard Windows capabilities, then the second suggests using third-party utilities that allow you to reset the Windows 7 administrator password. One of the most acceptable is Offline NT Password Editor, which allows you to gain full access to the OS system partition. You can either remove or change the password, or activate the administrator account. The utility does not provide a graphical interface, but nevertheless it is not at all difficult to understand. Each step is numbered and indicates what you need to do. So, what are the steps you need to follow to reset your password using this utility?

On another computer or laptop, go to the developer’s website, in the Bootdisk section, scroll to Download and download the version you need. The file name consists of numbers and letters. If you want to create a boot disk, download the file with cd in the name, but if you use a flash drive, then usb.
If you are using a disk, write the downloaded image using a burning program, and if using a flash drive, then perform the following manipulations:
- Copy the contents of the archive to a USB flash drive without creating any additional files.
- Expand Command Prompt as Administrator.
- Use the command f:\syslinux.exe -ma f:, where instead of f write the letter under which the flash drive is identified in Windows Explorer. If it doesn’t give any error, it means everything was recorded as expected.
- Insert your external media into the computer, set it in the BIOS as the first one to boot, and turn on the computer. The utility interface should start instead of the Windows Welcome window.

Step 1

The first step is to select the hard drive partition on which Windows is installed. The program provides a list of disk partitions indicating their size, which is what you should focus on. If you remember that the system is usually installed on drive C, which is several times smaller than drive D, it will be quite difficult to make a mistake. Enter the numbers with the section number and press the Enter button.

Step 2

After this, the utility asks which part of the registry needs to be loaded. Select 1 - Password reset, press the corresponding number and confirm with Enter.

Step 3

Changing or resetting a password by editing user data in the registry. The utility will launch chntpw Main Interactive Menu, in which item 1 - Edit user data and passwords - is immediately selected. Confirm your selection by pressing the Enter button. If you need to change the password, select 2 - Edit (set new) user password.

In the menu that opens, chntpw Edit User Info & Passwords, all computer accounts are displayed, with their code designation in hexadecimal notation (RID column). We are interested in the administrator account; most often it is displayed first in the list and is selected by default. If the account name is displayed in English letters, type it in the input field under the table; if in Russian, then use the information from the RID column. The entry in the input field will be in the format 0xABCD, where instead of ABCD you need to put the value from the table. The selection is confirmed with the Enter button.

Next, the User Edit Menu is displayed with a list of actions that can be performed with the administrator account. Select 1 - Clear (blank) user password and confirm with Enter. The program should report a successful password reset.

Step 4

Saving the changes made (Step Four: Writing back changes). Press successively! and q to exit the previous menus, after which the utility will offer to save the changes by issuing the request “About to write file(s) back! Do it? Enter y, and at the next prompt type n.

To reboot, enter the command reboot or click on the small button on the computer system unit. The system will start you up without asking for a password. You can install it yourself in the account management menu.

ERD Commander

Another fairly advanced utility for resetting the Windows administrator password. First, you will need to create a bootable USB flash drive with the utility on your work computer. For this:

Prepare a flash drive with a capacity of at least 1 GB, and also download the following four files: HPUSBDISK.zip, Ghost32.exe, Grub4dos.zip, ERD Commander image file in gho format.
Insert the flash drive into the computer, then run HPUSBdisk.exe, select your drive in the Device window, select File system as FAT32, and then click the Start button. The flash drive will be formatted, so make sure you save the important information stored on it somewhere.
Unpack the Grub4dos.zip archive and run grubinst_gui.exe, then select the flash drive in the Disk field and click the Install button at the very bottom. If the procedure completes successfully, you should see the following message: “The Mbr/bs has been successfully installed. Press to continue..." Now you can safely move on to the next stage.
Run Ghost32.exe - click Ok - Local - Disk - From Image, then select the ERD.gho file and click on it.
In the window that opens, select the flash drive, click Ok - Ok - Yes and wait until the bootable flash drive is completely created. This usually takes 10–15 minutes.

Now you have to work with the ERD Commander bootable flash drive. Here's what to do:

After connecting the flash drive to the computer, set the boot priority through the BIOS so that the flash drive comes first, and turn on the PC.
Select your version of Windows. If you confuse the system bit size, then it’s okay, just at the next stage the utility will give an error and you can repeat the procedure from the beginning.
After waiting for the download, select the installed operating system, click Next - Microsoft Diagnostics - Password Change Wizard.
You will see a window with a list of users and fields for entering a password. Select the administrator account, write down the new password and confirm it.
Remove the flash drive from the USB connector, boot into normal mode and use the new password.

Note! You won’t be able to find out your password this way, you can only delete it or set a new one!

Method 3. Substitution of system files

You've probably heard about the sticky keys feature. Simply press the Shift button 5 times quickly and a window will appear asking you to activate the mode. The file sethc.exe, located in the Windows system partition, is responsible for it. Interestingly, you can even activate it in the password entry window when Windows starts. But since the situation is that the user has forgotten it, we need to replace it with the cmd.exe file, which is responsible for opening the command prompt. How to do it?

Boot from external Windows media, in the installation window, click System Restore - Command Prompt.
Apply the following commands sequentially:
- copy c:\windows\system32\sethc.exe c:\- to create a backup copy of the sethc.exe utility.
- copy c:\windows\system32\cmd.exe c:\windows\system32\sethc.exe- to replace the file sethc.exe with cmd.exe.
Restart your computer normally.
When the password window appears, press the Shift button five times, which will open the Command Prompt.
To change your password, type the command net user login password, after which reboot again and now you will definitely be able to get into the system.

Note! You will not be able to find out the password this way, only delete it!

How to find out your account password

In this paragraph, we will learn how to hack the administrator password or simply find out it. Indeed, in many cases it is simply easier not to reset the password, but to simply assume that it is forgotten. To do this, we need the Ophcrack utility, which has the capabilities we need. It is capable of working in a graphical and text interface and, according to the creators, is able to find out almost any password stored on your system. How to use it?

Go to the official website and download the appropriate version: in the form of a program installation file if you can log into the system, or a Live CD to create bootable media if you can’t log into the system because you forgot your password.
Run the installation file or boot from a flash drive or disk and select the graphical or text interface of the utility.
Wait until the utility reads and displays the system passwords. Depending on the power of the computer, this may take different times.

That's all. As you can see, there is nothing complicated and if your password is not too complex, then the program will help you find it. You will then be able to log in again and enter your access code. Practice shows that if the password is very complex, consisting of a combination of large and small letters, as well as numbers, then the program may not cope.

Conclusion

We hope that our instructions helped you in a situation where you forgot your Windows account password. You now know how to reset it and install a new one. If you still have questions, ask them in the comments.

Everyone has situations when they need to find out the password for their Windows 7 account. Most often, it happens that the user has forgotten the login password, and it is undesirable to reinstall the entire system, because all data is lost.

And sometimes it happens that there are restrictions set on your work computer, and in order to remove them you need to log in through the Administrator account. If for any reason you are interested in how to find out the password for a Windows 7 computer if it is turned on, then this guide will help you.

Resetting your password on Windows 7

Unfortunately, or maybe vice versa, passwords to accounts are not stored in clear text anywhere. They are securely encrypted and protected. This is a guarantee of security for your data. But it also makes things more difficult if you need to find out a forgotten password or gain access to something. Therefore, let's start with the most trivial method, which, however, is not suitable in all cases - resetting the password.

This can be done without additional programs and skills, just follow the instructions:

Use the Win + R key combination to launch Command Prompt.
In the line that appears, type cmd and press Enter - the command line will open.
Enter the phrase net user and find out the name of the Administrator.
Repeat the previous command, adding the administrator name you learned in the previous step, separated by a space.
The password was reset automatically, and now the system asks you for a new one - leave the field blank if you want to log in without it.
Close the Command Prompt and reboot - you should now be able to log in to your Administrator account without any problems.

This is the best way for those who have forgotten their user password, and resetting it will not change anything. The same sequence of actions can be performed in Safe Mode, you just need to select the option with command line support.

How to find out the password for a Windows 7 computer if it is turned on using programs

But if it is not possible for you to reset your password, then you will need to download the program. Ophcrack is a utility that finds out the password using character selection. It is distributed free of charge, but with a limited number of dictionaries, with the help of which characters for the password are selected. If the available dictionaries are not enough, you will either have to purchase a paid version or use another method. You must have permission to install programs on your account.

After starting the installation, in the component selection window, check the last two items that say “Vista tables” - this also includes tables for Windows
After installation is complete, launch Ophcrack.
Most often, the search for accounts and selection of passwords for them occurs automatically. If this did not happen, and the utility did not even find users, click Load at the top, then LocalSam with samdump2. And then Crack.

Cracking a password without installing programs

But what if everything is much more complicated, and you cannot install programs on the system? And a solution has already been found for this. Using the same utility, only now on the website we download the version marked LiveCD - this is the version for a disk or flash drive.

When you connect the device, the Autorun window should appear, where you select the “Burn files to disk” option. You can also do this using special recording programs, if you have them.

Reboot the system. Booting from the disk or flash drive should start automatically. If this does not happen, go to the BIOS (on different laptops different keys are responsible for this - F2, from F8 to F12), there you can easily find the boot order, in first place you need to put the disk or flash drive - depending on what you are using.

The program loads and the automatic search begins. You don't need to do anything else - just wait a little while Ophcrack does everything.

If this method does not bring the desired result, it is also recommended to try the SAMInside program - an analogue of the previous one. The installation and operation algorithm is similar.

In this program, the methods for selecting passwords are more advanced, which is undoubtedly a plus, but it, like the previous one, is limited in use. To expand the capabilities you need to purchase the full version.

You can find a large selection of hacking programs on the Internet, and they are often updated, new hacking methods are created and existing ones are improved. The two mentioned utilities are the most popular and effective of those currently existing.

Find out the system password using keyloggers

It is impossible not to mention one more method - not entirely honest, but also has a right to exist. This is for the case when you are not the only computer user and you cannot find out the password assigned to your account personally.

Again, your account must have permission to install software. A keylogger is a utility that records all actions, including keyboard input. All information about actions performed in the system is entered into a file, by opening which you can find out not only passwords, but also a lot of other information entered from the keyboard.

There are a huge variety of such programs, including free ones, and finding them is easy. Just think before using this method. It is used as a last resort if all other methods and tricks do not work.

The fact is that it is not so difficult for an experienced PC user to discover this program, because these programs have already become widely known.

All of the above methods on how to find out the password for a Windows 7 computer if it is turned on are absolutely working today. Some of them are simpler, but do not give 100% results, others are more intricate.

Agree, if it were so easy to hack a password, everything in the world would be hacked and no one could give any guarantee of the security of their personal data. Therefore, the methods mentioned above are the most effective today.

We have the opportunity bypass password in windows 7 without resetting, if you forgot it? Of course have! Now we will tell you how to find out the account password or administrator password of Windows 7/8/10.

Method 1. Bypass Windows 7 password in safe mode

You can change your Windows password in Safe Mode using the following steps:

Step 1.Press F8 before the Windows boot screen.

Step 2: Select Windows Safe Mode - “Safe Mode with Command Prompt”→ Press “Enter” next.

Step 3: Type net user and press Enter, all accounts on Windows PC will be displayed.

Step 4: Enter your locked user account with the new password in the command line, for example, “Happy 123456” means your new password for the network user “Happy”.

Step 5: Once your computer restarts, you can automatically log into your computer with a new password.
(Note: When you recover Windows password from Safe Mode, an administrator account with a known password is required. If not, go to method 2)

Method 2. Bypass password in windows 7 using password reset disk

If you have created a Windows recovery disk with a password in the past, below are the steps to crack a forgotten password in Windows:

1. If you enter an incorrect password when trying to log in, Windows will display an incorrect password message. Click OK to close the message.

2. Click Reset Password, and then insert the password reset disk.

3. Follow the steps in the Password Reset Wizard to create a new password.

4. Log in with the new password. If you forgot your password again, you can use the same password reset disk. You don't need to create a new one.

(Note: The disk only works in a specific account, if you changed the Windows XP password for that account, it still works. But if you don't have a password reset disk, then the only way to bypass your Windows 7 password is using a third party application. )

Method 3. Hacking a Windows 7 password without a disk or flash drive

Windows Password Key– a third party utility, goes to the assistant when your computer is completely locked without a created password reset disk. Someone may suggest that you reinstall the system, but this is completely unnecessary. Windows Password Key Professional can help you reset your Windows password and successfully log into your computer again without the risk of losing data. Follow the three steps to pass Windows password; You'll soon be enjoying your PC.

Step 1: Log into any other accessible computer (not locked), download and install Windows Password Key.

Step 2. Copy CD/DVD or USB flash drives using this program.

Step 3: Insert the disc into your locked computer and follow the software wizard to bypass the forgotten Windows password with a burned CD/DVD or USB drive.

Video tutorial on how to bypass the administrator password in Windows 7 using WindowsPasswordKey

Whenever you have forgotten your Windows password, remember to use the Windows password key, and then you can easily and quickly unlock your forgotten Windows password in minutes!