Re: Windows XP Home machine login problem

I renamed the SAM file and rebooted the machine while windows was starting
it gave an error with the window title as "lsass.exe" a device has been
disconnected causing the user accounts.........click OK to reboot go into
safe mode and repair it.

Then i copied the SAM,SECURITY, SYSTEM, DEFAULT, SOFTWARE files from the
c:\windows\repair to pasted them in c:\windows\system32\config. After this
rebooted the machine still no change the machine boots but no usernames are
being displayed.

Bharani

"Pegasus (MVP)" wrote:

Yes.

Did you check for the existence of backup registry
files in c:\windows\repair?


"Bharani" <Bharani@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BC8BB395-77E5-47D9-AB98-3F9C38488118@xxxxxxxxxxxxxxxx
Ok i have a BART PE CD so i can use that to boot the machine. the SAM file
you are mentioning is it the one in C:\WINDOWS\system32\config?

Bharani

"Pegasus (MVP)" wrote:

Maybe your registry got hacked, maybe corrupted - who knows?
Do you have a firewall?

Under Win2000 I could rename the SAM file to something
else, thus removing all accounts. On the next boot I could
log on as Administrator with a blank password. I do not know
if this trick works under WinXP.

Here are a few methods to rename the SAM file:
- If your system partition is FAT32: Boot with a Win98 boot disk.
- Boot into the Recovery Console.
- Boot with a Bart PE CD.
- Temporarily run the disk as a slave disk in some other
Win2000/XP PC.

Making a Bart PE CD is a somewhat time-consuming exercise
but it's a terrific CD that I could not do without.


"Bharani" <Bharani@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:CE092152-F946-42D5-924A-7C6E3CEC5B76@xxxxxxxxxxxxxxxx
Hi thanks for the link. Used the CD to boot and select the option to
edit
usernames and passwords......i get a result saying " Cannot find
usernames
in
the registry" and then asks me to enter the username, i went with the
default
name "Administrator". When i did that i get a message saying " Cannot
find
value <\SAM\Domains\Accounts\Users\Names\Administrator\@>"

So i rebooted the machine with the same CD that you suggested and
selected
option "1 - to reset passwords, and then selected option "3 -
Recoveryconsole
Settings" result was " ERROR: SOFTWARE-hive not loaded"


I think the user data in the registry has been attacked??

Bharani



"Pegasus (MVP)" wrote:


"Bharani" <Bharani@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5C4FBA48-E815-4E74-8AB4-49BBA7A7C6CB@xxxxxxxxxxxxxxxx
When i boot the machine either in normal mode or safe mode, the
machine
boots
normally until it reaches the welcome screen.
In the welcome screen there are no user names displayed. so i
can't
logon
from there. If i try a pres CTRL+ALT+DEL i get the user prompt but
it
doesn't
accept any username password configuration that where originally
setup
in
the
machine including the "administrator" account.

The only thing that i can do from the welcome screen is to
shutdown
the
machine using the red shutdown icon at the bottom left corner of
the
screen.
When i do that the machine shuts down perfectly.

Bharani

http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html










.

Relevant Pages

  • [Full-Disclosure] SAM Switch - Win2k/XP password-less login
    ... go ahead and change the boot options in your BIOS ASAP. ... Since the disk loads the Windows NTFS partition as read write partition wouldn't it be nice if we could backup the SAM file and restore it if something went wrong. ... The SAM password injection technique as identified by Petter Nordahl should be addressed by the vendor. ...
    (Full-Disclosure)
  • Re: Windows 2000 Administrator lockout
    ... you can also boot up with knoppix-std and access ... (which is also on this boot CD) ... > a windows box, then you will need the SAM file of the station you ...
    (Security-Basics)
  • Re: Windows XP Home machine login problem
    ... Maybe your registry got hacked, ... Under Win2000 I could rename the SAM file to something ... If your system partition is FAT32: Boot with a Win98 boot disk. ...
    (microsoft.public.windowsxp.general)
  • Re: Lost of the Window XP password
    ... I tried to open the SAM file, ... You need to boot on of those and not into your Windows installation (you might ... you should set the Administrator password to blank. ... Microsoft MVP Scripting and WMI, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Windows XP Home machine login problem
    ... I have been just going through the same problem as you and have come up with a solution that fixed my HP Laptop. ... Using the Bart PE cd referenced in your earlier posts, I was able to boot the Laptop and work on the file system. ... Using the assumption that the SAM file was corrupted, I replaced the 5 registry files in the C:\windows\system32\config directory with a set of files from the system volume information (system recovery folder) snapshot folder (picking a date from about 10 days ago. ... Under Win2000 I could rename the SAM file to something ...
    (microsoft.public.windowsxp.general)