How To Temporarily Change Password for Windows User and Restore It Back

If your are servicing somebody other's PC, you may have need to access the local administrator account for a short time. But sometimes it's not possible to get in touch with PC owner (e.g. late at night), and it's undesireable to reset password permanently, because people don't like their things broken.

This article explains how to change Windows password temporarily, gain access to the user account for a short time, perform system maintenance, and restore original password back.

Contents

1. Intended audience and formulation of the problem

This feature is for computer technicians and support personnel, who need to have temporary access to the local administrator account only for the servicing time. This is only needed when the owner has password protected all local admin accounts, and it's not possible to get in touch with PC owner at the time of servicing of their PC (i.e., late at night or during their work hours).

Also, it's not desireable to reset user's password permanently in this situation: People don't like their things broken.

So, the problem is how to change password of Windows user temporarily, perform system maintenance, and restore original password back.

2. Theory of the solution

Windows passwords are stored in HKEY_LOCAL_MACHINE\SAM registry hive in hashed and encrypted form: one-way function is applied to the plaintext password, then it's encrypted with SYSKEY stored in HKEY_LOCAL_MACHINE\SYSTEM registry hive and stored on disk.

So, it's possible to decrypt password hash (SYSKEY is stored nearby), but it's not possible to dehash the password because of one-way function. Also, it's not possible to take SAM file from another PC with the same user names, because SYSKEYs will not match, so decrypted password hashes will contain random garbage and Windows will reject login attempts for all users.

But it's possible to backup local SAM file with unknown password and restore it back later when needed. Entire algorithm of setting temporary password:

  1. Boot into EBCD
  2. Run EBCD File Manager, backup C:\Windows\System32\Config\SAM.* with original passwords
  3. Run EBCD Password Wizard, change or reset password for local user with admin rights
  4. Boot into Windows, login with temporary password, perform system maintenance
  5. Boot into EBCD
  6. Run EBCD File Manager, restore C:\Windows\System32\Config\SAM.* with original passwords

3. Step by step guide

1) Download EBCD and burn it to CD/DVD according to the instructions, then set up your BIOS to boot from CD. You need full EBCD version to actually write changes to the disk, but it's recommended to try demo version first to make sure  there are no hardware incompatibilities.

2) Boot EBCD and run File Manager from the main menu:

Using EBCD to Change Windows Password and Restore It Back - Main Menu
Using EBCD to Change Windows Password and Restore It Back - Main Menu

3) File Manager will open disk Z: on both panels:

Using EBCD to Change Windows Password and Restore It Back - File Manager at Disk Z
Using EBCD to Change Windows Password and Restore It Back - File Manager at Disk Z

4) Press Alt+F2 and choose your Windows system partition on the right panel (D: in this example):

Using EBCD to Change Windows Password and Restore It Back - Choosing Windows System Partition on the Right Panel
Using EBCD to Change Windows Password and Restore It Back - Choosing Windows System Partition on the Right Panel

5) Press ENTER and make sure that list of files and folders look familiar. Navigate to the Windows folder using arrow cursor keys and then press ENTER:

Using EBCD to Change Windows Password and Restore It Back - Entering Windows folder
Using EBCD to Change Windows Password and Restore It Back - Entering Windows folder

6) Inside Windows folder, navigate to the system32 subfolder using arrow cursor keys and then press ENTER:

Using EBCD to Change Windows Password and Restore It Back - Entering System32 subfolder
Using EBCD to Change Windows Password and Restore It Back - Entering System32 subfolder

7) Inside system32 subfolder, navigate to the config subsubfolder using arrow cursor keys and then press ENTER:

Using EBCD to Change Windows Password and Restore It Back - Entering Config subsubfolder
Using EBCD to Change Windows Password and Restore It Back - Entering Config subsubfolder

8) Make sure SAM and SAM.LOG files are there:

Using EBCD to Change Windows Password and Restore It Back - Checking Existence of Windows Password Database File
Using EBCD to Change Windows Password and Restore It Back - Checking Existence of Windows Password Database File

9) Press Alt+F1 and choose your Windows system partition on the left panel (D: in this example):

Using EBCD to Change Windows Password and Restore It Back - Choosing Windows System Partition on the Left Panel
Using EBCD to Change Windows Password and Restore It Back - Choosing Windows System Partition on the Left Panel

10) Press ENTER and make sure that list of files and folders look familiar. Press TAB to switch input focus to the left panel:

Using EBCD to Change Windows Password and Restore It Back - Switching to the Windows System Partition on the Left Panel
Using EBCD to Change Windows Password and Restore It Back - Switching to the Windows System Partition on the Left Panel

11) Press F7 to request folder creation. Enter "sam_backup" or other similar name:

Using EBCD to Change Windows Password and Restore It Back - Creating backup folder for Windows Password Database
Using EBCD to Change Windows Password and Restore It Back - Creating backup folder for Windows Password Database

12) Press ENTER to confirm operation and make sure sam_backup folder appears on the left panel:

Using EBCD to Change Windows Password and Restore It Back - Ensuring backup folder for Windows Password Database is created
Using EBCD to Change Windows Password and Restore It Back - Ensuring backup folder for Windows Password Database is created

13) Press ENTER to enter sam_backup on the left panel, then press TAB to switch input focus to the right panel, navigate to the SAM file and press INSERT key twice to select it and the next file (SAM.LOG):

Using EBCD to Change Windows Password and Restore It Back - Select Windows Password Database for Backup
Using EBCD to Change Windows Password and Restore It Back - Select Windows Password Database for Backup

14) Press F5 to open file copy dialog, make sure everything is right and confirm with ENTER:

Using EBCD to Change Windows Password and Restore It Back - Confirm Backup of Windows Password Database
Using EBCD to Change Windows Password and Restore It Back - Confirm Backup of Windows Password Database

15) Make sure SAM and SAM.LOG files appear on the left panel, then press F10 and ENTER to exit EBCD File Manager:

Using EBCD to Change Windows Password and Restore It Back - Exit EBCD File Manager
Using EBCD to Change Windows Password and Restore It Back - Exit EBCD File Manager

16) Run "Windows Password Wizard" from EBCD main menu:

Using EBCD to Change Windows Password and Restore It Back - Running Windows Password Wizard from EBCD
Using EBCD to Change Windows Password and Restore It Back - Running Windows Password Wizard from EBCD

17) Please read this carefully. If you don't agree, do not use the software and do not continue to read this guide:

Using EBCD to Change Windows Password and Restore It Back - License Agreement for EBCD Windows Password Reset Tool
Using EBCD to Change Windows Password and Restore It Back - License Agreement for EBCD Windows Password Reset Tool

18) Choose user account to change password for. It's called "User" in this example:

Using EBCD to Change Windows Password and Restore It Back - Choosing User Account to Change Password For
Using EBCD to Change Windows Password and Restore It Back - Choosing User Account to Change Password For

19) Enter the new password ("1234" in this example) and press ENTER. You may use empty password if you wish:

Using EBCD to Change Windows Password and Restore It Back - Setting New Password For Windows User Account with EBCD
Using EBCD to Change Windows Password and Restore It Back - Setting New Password For Windows User Account with EBCD

20) You should see the following message:

Using EBCD to Change Windows Password and Restore It Back - Password For Windows User was changed successfully with EBCD
Using EBCD to Change Windows Password and Restore It Back - Password For Windows User was changed successfully with EBCD

21) Choose "Reboot" in EBCD main menu.

Using EBCD to Change Windows Password and Restore It Back - Rebooting into Windows for system maintenance
Using EBCD to Change Windows Password and Restore It Back - Rebooting into Windows for system maintenance

22) Boot into Windows and perform system maintenance as planned. Use "1234" or another temporary password you've set on the step 19 in order to log on into Windows.

23) Boot into EBCD and choose File Manager in the main menu:

Using EBCD to Change Windows Password and Restore It Back - Running File Manager to restore Password For Windows User
Using EBCD to Change Windows Password and Restore It Back - Running File Manager to restore Password For Windows User

24) File Manager will open disk Z: on both panels as usually:

Using EBCD to Change Windows Password and Restore It Back - Running File Manager Again
Using EBCD to Change Windows Password and Restore It Back - Running File Manager Again

25) Press Alt+F1 and choose your Windows system partition on the left panel (D: in this example):

Using EBCD to Change Windows Password and Restore It Back - Switching to the Windows System Partition on the Left Panel
Using EBCD to Change Windows Password and Restore It Back - Switching to the Windows System Partition on the Left Panel

26) Switch input focus to the left panel with TAB key. Using arrow keys, navigate to sam_backup folder and enter that folder:

Using EBCD to Change Windows Password and Restore It Back - Entering the folder with backup copy of Windows Password Database
Using EBCD to Change Windows Password and Restore It Back - Entering the folder with backup copy of Windows Password Database

27) Press Alt+F2 and choose your Windows system partition on the right panel (D: in this example):

Using EBCD to Change Windows Password and Restore It Back - Switching to the Windows System Partition on the Right Panel
Using EBCD to Change Windows Password and Restore It Back - Switching to the Windows System Partition on the Right Panel

28) Go to Windows folder and press ENTER:

Using EBCD to Change Windows Password and Restore It Back - Entering Windows folder (in order to Restore Original Password of Windows User)
Using EBCD to Change Windows Password and Restore It Back - Entering Windows folder (in order to Restore Original Password of Windows User)

29) Go to system32 subfolder and press ENTER:

Using EBCD to Change Windows Password and Restore It Back - Entering System32 subfolder (in order to Restore Original Password of Windows User)
Using EBCD to Change Windows Password and Restore It Back - Entering System32 subfolder (in order to Restore Original Password of Windows User)

30) Go to config subsubfolder and press ENTER:

Using EBCD to Change Windows Password and Restore It Back - Entering Config subsubfolder (in order to Restore Original Password of Windows User)
Using EBCD to Change Windows Password and Restore It Back - Entering Config subsubfolder (in order to Restore Original Password of Windows User)

31) Make sure SAM and SAM.LOG files are there. Press TAB to switch input focus to the left panel, then go to the original SAM file on the left panel and press INSERT twice (in order to highlight SAM and SAM.LOG for copying):

Using EBCD to Change Windows Password and Restore It Back - Selecting original SAM files (in order to Restore Original Password of Windows User)
Using EBCD to Change Windows Password and Restore It Back - Selecting original SAM files (in order to Restore Original Password of Windows User)

32) Press F5 to open file copy dialog. Make sure target path for copying is right. Confirm with ENTER:

Using EBCD to Change Windows Password and Restore It Back - Initiating password restore (in order to Restore Original Password of Windows User)
Using EBCD to Change Windows Password and Restore It Back - Initiating password restore (in order to Restore Original Password of Windows User)

33) Choose "Overwrite All" in this dialog:

Using EBCD to Change Windows Password and Restore It Back - Confirming Overwrite (in order to Restore Original Password of Windows User)
Using EBCD to Change Windows Password and Restore It Back - Confirming Overwrite (in order to Restore Original Password of Windows User)

34) Screen should look like this after copying. You may go up on the left panel by pressing ENTER on .. item and then press F8 to delete sam_backup folder. Then press F10, ENTER to exit EBCD File Manager

Using EBCD to Change Windows Password and Restore It Back - Done, Original Password of Windows User is Restored Successfully
Using EBCD to Change Windows Password and Restore It Back - Done, Original Password of Windows User is Restored Successfully

35) Finally, choose "Reboot" in EBCD main menu. Next time Windows boots, the user will be able to log on with his/her original password.

Using EBCD to Change Windows Password and Restore It Back - Rebooting, System Maintenance is Complete
Using EBCD to Change Windows Password and Restore It Back - Rebooting, System Maintenance is Complete