How to get local administrator password

[she-ra]

I need to get the local administrator password on W2K and XP machine in order to change it.
Does anyone know a good API ?

thanks

[Alex Fedotov]

There is no way to obtain user's password on NT. It isn't even stored anythere on the harddrive, only its one-way hash is.

[billwilson3]

It would be a pretty large hole in the security if what you want is possible.
Why do you want to do it?

[alanr]

I think you can, it takes several days to decrypt though:

http://www.atstake.com/research/lc/index.html

[billwilson3]

Very interesting.

I wonder, does it actually crack the code or simply use the same algorythm to encrypt trial words, until it gets a match? If this is a keyed encryption system, It would have to guess both the password and the key.

I couldn't think of any legitimate uses of such an app. I suppose an app like the one in the link is a legitimate reason. Any others?

[she-ra]

Actually I have found a good toolkit from the Win2K resource kit that can (among other things) change the administrator's or any other local user password without knowing the old password.
You can even change the administrator's password without logging in as an administrator....
the name of this tool is cusrmgr.exe.
I wonder, isn't this a major hole in the security???

[billwilson3]

Do you have to have admin rights already to use it?

[Zhefu Zhang]

It may seem odd I post this after 1 year
Actually there is a way to obtain your current password in Win2k/XP:
http://nfans.net/article/manu/26.html
Just omit the Simplified Chinese and copy-paste the code, it works except a few recoverable typo.

Oh, I didn't say you can get Admin's password unless he permit you to run his machine for a few seconds and you guy get the pwd by this way