Kali linux сброс пароля windows 10

Hello and Welcome,

Here I am with another article on recover windows 10 administrator password. If you have laptop installed window 1o and Forgot password on laptop. then some questions will arise in your mind “how to recover windows 10 OS password on a laptop?” or  “how to recover laptop password?” so you are searching for solution, and solution here I am resetting my password by Kali Linux.

Similar as previous version of Window’s Operating system like Window XP/7/8/8.1 password of Window 10 are saved in SAM (Security Account Manager) file located in C:/Windows/system32/config. These password are encrypted with NTLMv2. In this post I will show you to dump the hashes and crack it using John password cracker tool. User can do that by follow the given steps:

Step 1:Boot Window machine with Kali Linux Live DVD/Flash Drive

Step 2: Mount Windows System Drive

1. Click on the Places and the menu bar will open click on Computer. The file manager will open.
2. Click on other location, and again click on the Windows media. New windows will be open and looks like image.
   Note: If you will not able to open this drive automatic use following command to fix error. This happen because Windows 10 does not shut down properly. By default it is going to sleep mode, So you will have to run following command.
   #fdisk -l
   this command is used to check the attached hardisk and its partition. its upto you how will you find the windows partition. if you will run following command with wrong partition, then no issue.
   #ntfsfix /dev/sda2 (partition address)
3. Try again to open Windows media, Once you will open go to next step.

Step 3: Open terminal and Go into the SAM file location

#cd /Media/Media No./Windows/System32/config

Old method to get windows 10 password hashes

Step 4: Find the system bootkey using bkhive utility

#bkhive SYSTEM /root/Desktop/system

Step 5: Dump Password hashes using samdump2

#samdump2 SAM /root/Desktop/system > /root/Desktop/hashes.txt

New Method to get windows 10 password hashes – 2017

STEP 4+5: This is very important step, because in this step you are going to retrieve Windows 10 password hashes. So run the following command and dump the hashes.

#pwdump SYSTEM SAM > /root/Desktop/hashes.txt

You can provide any name instead of hashes.txt

Step 6: Change working directory as /root/Desktop

#cd /root/Desktop

Step 7: See available hashes in hashes.txt file

#cat hashes.txt

Step 8: Find the password from hashes using John the Ripper

#john –format=nt2 –users=UserName hashes.txt

Find the password Have a fun 🙂

Method 2. How to Recover Windows 10 administrator password If You Forgot.

Another tool that can be used to recover windows 10 administrator password is the iSeePassword Windows Password Recovery Pro, this is a best PC Unlocker software. It is a professional password recovery tool that is meant to reset or unlock computer password. It is available for many other Windows operating systems including Windows Vista, 7, 8 and XP. You only need a USB flash drive. When compared to other methods mentioned above, this is the easiest way to recover a lost password and has no drawbacks. It works by listing all user accounts on your computer, you only need to select a user account on your computer and click the password reset button. You can login to your Windows account after restarting.

Let’s see how iSeePassword Windows Password Recovery Pro Works.

Step 1. Download iSeePassword Windows Password Recovery Pro and install and launch it on another available PC. There are 2 ways to burn a password reset disk, USB or DVD/CD,  just inset a USB flash drive into it. Click “Burn”.

Step 2. When successful message pops up, click OK and exit removal device. Password recovery disk have been burned successfully.

Step 3: Insert the newly created USB drive to the locked Windows 10 computer. Set USB drive as the first boot device in BIOS setup. This computer will reboot. Then it will load the program, and detect all system and account on your computer, follow the interface to reset your Windows 10 password.

After you successfully reset the password, disconnect the boot disk and reboot your PC when password is reset to blank. Then your PC will restart normally and Windows 10 can login without password.

iSeePassword Windows Password Recovery Pro is easy to use and safe. With it,you can fast access to your windows if you forgot login password on Windows 10 without system re-installation.

You’re locked out of your Windows 10 computer because you forgot the password, and now you’re wondering whether you’ll have to reinstall the operating system to regain access.

Stop right there!

Before you go and do something as drastic and final as that (you’ll lose all your data and settings), consider other methods of unlocking a Windows 10 PC. This article shows you how to reset a Windows 10 password using Kali Linux, as well as another, easier option.

#1 Creating the Linux Live CD or Drive

The first step is to create what is called a bootable drive or disk for Kali Linux. Obviously, you can’t do it on your locked PC, so you’ll need a different Windows computer for this part of the process. Make sure you have admin access and that the system has an optical drive or a working USB port.

On your secondary computer, download the latest Kali Linux bootable ISO file (download file from here) and insert a storage device. USB is recommended since it’s more portable, but you can also use a physical disk.

For creating the bootable Kali Linux drive or disk, you can use a free ISO burner like Universal USB Installer or Free ISO Burner. If the other computer is also running Windows 10, you can use Command Prompt to create the bootable Kali Linux installer.

Remember, we’re not actually going to load Kali on your locked PC!

we’re merely using it as an OS pre-installation environment so the password can be reset, once again using Command Prompt.

#2 Booting to CMD with Admin Access

Once you have the Linux installer in hand, remove it and insert it into the computer that’s locked. Hit the boot key on start-up so it boots to the BIOS Utility Setup. Change the boot priority as your installer disk or drive, save the changes and exit to resume boot.

Choose Live System or Live (forensic mode) from the options you see in the Kali boot menu. You should now be able to navigate to /system32, where your Windows OS is loaded. When in that drive location, open Terminal in Kali Linux and execute this command:

cd /media/root/DCC056BBC0569B98/windows/system32

Next, we’re going to use the Accessibility feature in Windows 10 to bypass password security. Once we can access CMD, we’ll be running another command to change the password without having to know the old one. But first, run this command:

mv Magnify.exe magnify.old

mv cmd.exe Magnify.exe

#3 Resetting the Password

Now that we’ve switched the cmd executable with the magnify executable, this is what will happen: when you exit Linux and reboot to Windows 10, click the Accessibility icon and then on where it says Magnifier.

Since we swapped the two .exe files in the last step, you will see CMD open with admin access privileges. You can now change the password by executing this next command:

net user

Change the parameters within the angle brackets as appropriate. Your password has now been reset, but don’t forget to switch back the magnify.exe and cmd.exe files.

Once that’s done, you can reboot normally and log in with the new password.

A Better Alternative to Reset Windows 10 Password

If you feel that’s too complex for you to mess around with, don’t worry. There are other tools like WinPWD Windows Password Recovery that can help you create a bootable password reset disk and simply blank your current password even if you don’t remember it.

This one is a particularly intuitive tool that uses a built-in ISO burning tool and WinPE environment along with the code for the actual password reset process. And it’s designed for first-time users who have forgotten their Windows login password.

It works by allowing you to create a password reset disk on any other Windows computer (again, with admin access and a working USB port or DVD drive) and then use that to almost instantly unlock your password. Just download the utility on the other PC and click a couple of buttons to create your reset disk.

This can then be used to boot your locked Windows 10 machine. The interface lets you select the right ISO file and unlock any local or network user account password with just one click.

If the Kali Linux method of resetting your Windows 10 password looks a little daunting, PassMoz LabWin can get you out of the jam in just a few minutes.

Even there are other methods to reset windows 10 password like the one we have mentioned here- Reset Windows Password Without Disk.

Do you forget your password to Windows 10 local account and can’t pass the lock / login page at all? The problem is, that locked account is the only account on that computer and it’s a local administrator account.

I experienced that nightmare the other day.

I searched some free solutions online for that matter. Many tutorials suggest to use Offline NT Password & Registry Editor from Pogostick, but I didn’t have any luck using it to reset Windows 10 login password. Some of the errors I got were «Kernel panic — not syncing: Attempted to kill init! exitcode=0x0000000b» and stuck on «Booting the kernel.»

After tried several solutions, tools, and faced some troubles along the way, I was finally able to remove my Windows 10 local account’s login password.

Below I put together what I did to remove Windows 10 local administrator account login password in easy step-by-step.

What you need to remove Windows 10 login password

• Kali Linux ISO. Download it from Kali Linux Downloads page. For this tutorial, I used version 2019.2 of Kali Linux 64-Bit. [Update on 26 May 2022: If you want to use this specific Kali Linux’s old version, you can download it here: kali-linux-2019.2-amd64.iso]
• Universal USB Installer (UUI). Download it from Pendrivelinux UUI. I used version 1.9.8.7. [Update on 26 May 2022: this older version (UniversalUSBInstaller1.9.8.7) can be downloaded from archive.org]
• USB Flashdrive. Kali Linux used about 3.1 – 3.4 GB.
• Computer. You need access to a computer to install Kali Linux on USB flashdrive.

Steps to remove Windows 10 login password

1. Download Kali Linux ISO and Universal USB Installer from above links.
2. Plug in a USB flashdrive that you want to use as a bootable USB drive to a computer that you have access to.
3. Run Universal USB Installer (UUI) .exe file on the same computer as the USB’s. Setup UUI:
   1. On Step 1, select «Debian Live».
   2. On Step 2, check the «Show All ISOs?». Browse and select the Kali Linux .iso file that you downloaded.
   3. On Step 3, select the USB drive
   4. Click «Create»

1. Now let’s move to the computer whose password you forgot. Plug in the Kali Linux bootable USB.
2. Go to the computer’s BIOS settings. How to enter the BIOS settings will vary depend on your computer’s manufacturer — please check the manual book. Some ways that you can try are:
   1. Press the turn on button, and immediately press F12. The screen will go dark for a moment, then open the BIOS settings.
   2. OR, you can try to boot up until you reach the login screen. Hold Shift button while you select the Restart option. You will enter Advanced Boot Options blue screen with big title «Choose an option». Select «Troubleshoot» > «Advanced options» > «UEFI Firmware Settings». Click «Restart».
3. Change the boot order so that the computer will boot from the USB drive first. If you don’t find the option to boot from USB drive, try to check and make sure (however, again, it depends on your computer’s manufacturer BIOS settings):
   1. The «USB Boot» is enabled
   2. Boot mode support Legacy and boot priority is Legacy First.
4. Save changes and restart the computer
5. You will boot to Kali Linux Live screen. Choose «Live (forensic mode)»

1. Go to System32 folder. Navigate from «+Other Locations» > «Windows» > «Windows» > «System32». Select «Open in Terminal» option from the dropdown menu.

1. Go to config folder by typing: cd config
2. In the config folder, type chntpw -l SAM to list user(s). Note the username.
   1. If you get error in this step that read as follow: read error: : Read-only file system, turn off the computer and remove the bootable USB.
   2. Turn on the computer again until it reaches the Windows login screen. Plug in the bootable USB. Choose the Restart option from Windows login screen. Let it boot from the USB.
   3. Do the steps 8-11.
3. Type chntpw -u USERNAME SAM to open details of the specific username. Change the ‘USERNAME’ with your username, e.g chntpw -u John SAM
4. Type 1 to choose option number 1 — Clear (blank) user password.
5. Type q to quit editing user
6. Type y
7. Turn off the computer. Remove the bootable USB. Turn on the computer.
8. Enter the BIOS settings to change boot order to Windows again.
9. You should now be able to enter Windows 10 with your administrator account without any password. You can set password to your account again from the Windows user settings.

Table of Content

• What is Windows 10 O.S?
• What is the chntpw tool?
• How to install chntpw in Kali Linux 2021.2?
• How to Remove Windows 10 login password?

What is Windows 10 O.S?

Windows 10 is the most popular GUI-Based operating system developed by Microsoft Corporation. It works on the graphical user interface (GUI), whereas Linux works on the command-line interface (CLI). In addition, the latest version of Windows 11 is launching with an attractive look and many features, which is an upgraded version of Windows 10.

What is the chntpw tool?

The chntpw is a windows password resetting or blanking tool that’s pre-installed in Kali Linux. We can quickly remove user passwords from Windows 10,8,7 with the help of the chntpw tool. Kali Linux contains over 400 forensics and penetration testing tools. We would be like to say that Windows stores the user’s password as a hash in the SAM database. The Security Accounts Manager (SAM) is a database that exists in the system32 folder.

How to install chntpw in Kali Linux 2021.2?

In some operating systems, the chntpw tool may not pre-install. We will be here to cover, How to install the chntpw tool in Kali Linux. To get more information, follow the below image.

apt-get install chntpw

How to Remove Windows 10 login password?

Suppose you are CEO of a company and 100 employees work there. Due to some reason, an employee left your company. He entered a password in Windows 10, which is running on that computer. In this situation, how will you remove that password?

But you don’t know how to Remove Windows 10 login password without losing data. “Don’t worry” In this blog, we will reset Windows 10 passwords with the help of the chntpw tool.

If you don’t know how to create a Kali Linux bootable Pen drive, I have caused a video on it. First, you should watch that video.

According to the image, as soon as I tried to log in to Windows 10, I got the message of password inaccessible. We entered the password several times, but our attempt was unsuccessful. I comprehended that with the help of some hacking tools can be easily bypassed Windows login password. For that, you will need a bootable Pen drive. I am using here the latest Kali Linux 2021.2 bootable ISO image.

Before rising this blog, we should comprehend the working of the chntpw tool. Remember, you must have a SAM file. As you know, we have mentioned above. The Security Accounts Manager (SAM) is a database that exists in the system32 folder. To get more information, We can see its help, for that, follow the below command.

chntpw -h 

• -l = If you want to scan all users, then use the -l command.
• -e = If you want to edit your Windows registry, then use the -e command.

At this time, we will have to initiate Kali Linux in live mode. After that, we will select Live (AMD64). It may take some time. Till then, be patient!

Let’s get remove Windows 10 password without losing data. First, we would enter in Windows 10 drive. If you have a good knowledge of Linux, then you will not have any problem here. Let’s come to the topic. We would open a Windows drive in the Kali Linux terminal. Following the below image.

In this stage, we will find out all user’s in Windows 10. Let’s follow the below command!

chntpw -l SAM

If you don’t know about Linux basic command, I have caused a video on it. First, you should watch that video.

Let’s take a closer look at the picture. We have got all user’s lists of Windows 10. According to the above image, we have a SAM file used with the chntpw tool.

I have got my username, we have marked it. We would remove windows login passwords without losing data. When you would execute the chntpw tool, It will display a bunch of options. It depends on you, which type of options you would select.

We can convert the guest user into an administrative user and remove the password. We want to say, let’s take a closer look at the picture.

We would select the 1 title to remove the Windows login password.

• 1 – Clear (blank) user password

We got happy. We didn’t think that we can remove the Windows login password. If you do like this blog, then subscribe to the Pentestblog YouTube channel.

Recent Posts

Most Popular Posts