How-To : Reset your "local admin" password from Setup Media

This is a tutorial on how you reset your local admin account on a member server (no not the domain account) when you have forgotten the password it misplaced it, ideally you should be using LAPS but that is another question - like many on the internet, but this one is mine.

Server Security

This is a reason why you should ensure your servers are physically secure and that the BIOS/UEFI is not "open" without a password and you should now allow booting off virtual media for this reason, this guide makes it very easy to bypass Windows security with a setup ISO

Ensure that your BIOS is always protected with a password, the boot menu can only be accessed by authorised personnel and your security hygiene is good.

Locate the ISO

First you need the media on a ISO file that has your flavour of choice, for this example I am using Server 2019 the ISO is shown below:

Physical Server : Use Remote Access (iLO for HP)

We now need the remote control the server via the remote management solution, in this case we have a HP server so you will need to use iLO - other manufactures will have their own remote control, once you have this loaded you need to attach that ISO to the media on the iLO

Then you need to boot you server from the ISO file which may require the F8 key and you may be required to "press any key to boot from CD / DVD..."

Virtual Server : Mount ISO in virtual device

We now need the remote control the server and if you are using a Hypervisor that is as simple as, in VMware, taking the console session and then attaching the media to the VM.

Then you need to boot you server from the ISO file which may require the F8 key and you may be required to "press any key to boot from CD / DVD..."

Allow Windows to boot of ISO

You now need to wait for Windows to boot of the ISO and after a short wait you should get a screen like this:

When you get here do not click the install button, instead you need to click the "Repair" button shown below in the green box:

You then need to choose the Troubleshoot option as below:

Then finally you need the "Command Prompt" option as below:

Utilman.exe

Utilman.exe is what usually appears when you click the Accessibility icon on the login screen for Windows as below:

In this tutorial we will switch it for cmd.exe which is the command prompt to get access to the server, then when you use the icon or keyboard shortcut you will get the command prompt (as system) not accessibility.

Switch utilman.exe with cmd.exe

Note : This action should be blocked by your antivirus which is the reason we boot off the setup ISO and we do not try to do this in Windows normally.

You will then get a command prompt on your screen and from here you need to type these commands:

Note : You should really have renamed the "Administrator" account to another name, if you cannot remember that name then use the command:

net users

That will then give you a list of all the users on the server, then you can proceed with the following commands:

D:

cd Windows

cd System32

move utilman.exe utilman.exe.bak

copy cmd.exe utilman.exe

net user administrator /active:yes

shutdown -r -t 0

Start Recovery command prompt 

Once you server has rebooted without booting off the ISO,  you then need to press the key combination of 

Windows Key + U

This will show you the command prompt to which you need to enter these commands:

net user Administrator S3cu5ePa55w0rd
exit

Advice : Before you reboot after you’ve typed exit, ensure you can log into the server with the password you’ve just set, if so Mission accomplished 

Reboot and rollback changes

When you type exit the command prompt will vanish as you can login as normal once you are logged in you then need to rollback the "recovery command prompt" for this restart you computer and boot off the ISO again then enter the same command prompt and run these commands:

D:
cd Windows
cd System32
del utilman.exe
ren utilman.exe.bak utilman.exe
shutdown -r -t 0

Once the server is rebooting remove the virtual media from the DVD drive and let your server boot normally.