Guest Jeff Posted October 9, 2007 Posted October 9, 2007 Hello everyone, I'm trying to reset the password for just the recovery console of an application server. This server is on an Active Directory network but is not a domain controller and is a 2003 SP2 server. I found articles/info about setting the Directory Services Restore password, but nothing on resetting the local administrator password. The local admin listed on the machine in Local Users and Groupds is the domain administrator account, but not the local administrator. I had an issue with a corrupted system file or registry hive and wasn't able to log on to the recovery console using the domain admin password or the old local admin password that I had on file. (thank goodness that I was able to degrade a RAID 1 array and boot off of a single drive) Any help would be greatly appreciated. -- Thanks, Jeff
Guest Jeff Posted October 9, 2007 Posted October 9, 2007 RE: Reset Recovery console password Can anyone tell me if the instructions in the following article, under step 3 in regards to the server "null" value is what I'm looking for? http://support.microsoft.com/kb/322672/en-us -- Thanks, Jeff "Jeff" wrote: > Hello everyone, > > I'm trying to reset the password for just the recovery console of an > application server. This server is on an Active Directory network but is not > a domain controller and is a 2003 SP2 server. I found articles/info about > setting the Directory Services Restore password, but nothing on resetting the > local administrator password. The local admin listed on the machine in Local > Users and Groupds is the domain administrator account, but not the local > administrator. > > I had an issue with a corrupted system file or registry hive and wasn't able > to log on to the recovery console using the domain admin password or the old > local admin password that I had on file. (thank goodness that I was able to > degrade a RAID 1 array and boot off of a single drive) > > Any help would be greatly appreciated. > > -- > Thanks, Jeff
Guest Jeff Posted October 9, 2007 Posted October 9, 2007 RE: Reset Recovery console password Another note to add. I attempted the instructions in the article below and I received an error message using NTDSUTIL: Setting password failed. WIN32 Error Code: 0x32 Error Message: The request is not supported. Then it takes me back to the DSRM admin password prompt. So, the first question in this post is still valid, but it'd be interesting to find out why the KB article instructions did not work either. -- Thanks, Jeff "Jeff" wrote: > Can anyone tell me if the instructions in the following article, under step 3 > in regards to the server "null" value is what I'm looking for? > > http://support.microsoft.com/kb/322672/en-us > -- > Thanks, Jeff > > > "Jeff" wrote: > > > Hello everyone, > > > > I'm trying to reset the password for just the recovery console of an > > application server. This server is on an Active Directory network but is not > > a domain controller and is a 2003 SP2 server. I found articles/info about > > setting the Directory Services Restore password, but nothing on resetting the > > local administrator password. The local admin listed on the machine in Local > > Users and Groupds is the domain administrator account, but not the local > > administrator. > > > > I had an issue with a corrupted system file or registry hive and wasn't able > > to log on to the recovery console using the domain admin password or the old > > local admin password that I had on file. (thank goodness that I was able to > > degrade a RAID 1 array and boot off of a single drive) > > > > Any help would be greatly appreciated. > > > > -- > > Thanks, Jeff
Guest Meinolf Weber Posted October 9, 2007 Posted October 9, 2007 RE: Reset Recovery console password Hello Jeff, No, this can't help you, because the machine is a member server not a domain controller. The DSRM you only have on domain controllers not on member servers. Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. > Can anyone tell me if the instructions in the following article, under > step 3 in regards to the server "null" value is what I'm looking for? > > http://support.microsoft.com/kb/322672/en-us > > "Jeff" wrote: > >> Hello everyone, >> >> I'm trying to reset the password for just the recovery console of an >> application server. This server is on an Active Directory network >> but is not a domain controller and is a 2003 SP2 server. I found >> articles/info about setting the Directory Services Restore password, >> but nothing on resetting the local administrator password. The local >> admin listed on the machine in Local Users and Groupds is the domain >> administrator account, but not the local administrator. >> >> I had an issue with a corrupted system file or registry hive and >> wasn't able to log on to the recovery console using the domain admin >> password or the old local admin password that I had on file. (thank >> goodness that I was able to degrade a RAID 1 array and boot off of a >> single drive) >> >> Any help would be greatly appreciated. >> >> -- Thanks, Jeff >>
Guest Meinolf Weber Posted October 9, 2007 Posted October 9, 2007 RE: Reset Recovery console password Hello Jeff, Sorry did a mistake, yes the NULL part is your option on the local computer. Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. > Hello Jeff, > > No, this can't help you, because the machine is a member server not a > domain controller. The DSRM you only have on domain controllers not on > member servers. > > Best regards > > Meinolf Weber > Disclaimer: This posting is provided "AS IS" with no warranties, and > confers > no rights. >> Can anyone tell me if the instructions in the following article, >> under step 3 in regards to the server "null" value is what I'm >> looking for? >> >> http://support.microsoft.com/kb/322672/en-us >> >> "Jeff" wrote: >> >>> Hello everyone, >>> >>> I'm trying to reset the password for just the recovery console of an >>> application server. This server is on an Active Directory network >>> but is not a domain controller and is a 2003 SP2 server. I found >>> articles/info about setting the Directory Services Restore password, >>> but nothing on resetting the local administrator password. The >>> local admin listed on the machine in Local Users and Groupds is the >>> domain administrator account, but not the local administrator. >>> >>> I had an issue with a corrupted system file or registry hive and >>> wasn't able to log on to the recovery console using the domain admin >>> password or the old local admin password that I had on file. (thank >>> goodness that I was able to degrade a RAID 1 array and boot off of a >>> single drive) >>> >>> Any help would be greatly appreciated. >>> >>> -- Thanks, Jeff >>>
Guest Jeff Posted October 9, 2007 Posted October 9, 2007 RE: Reset Recovery console password Thanks for letting me know. I gave this a shot on the local machine and can access the NTDSUTIL application, but received an error message (posted above too): Setting password failed. WIN32 Error Code: 0x32 Error Message: The request is not supported. Perhaps this is because this is a member server and not a DC? Any ideas? I'm surprised that this topic isn't documented somewhere. I can't be the only person who's tried to use the recovery console to repair a system and had lost the original password. Better yet, if there was a security breach and an admin wanted to reset all the recovery console passwords (especially if they were left as 'blank'). -- Thanks, Jeff "Meinolf Weber" wrote: > Hello Jeff, > > Sorry did a mistake, yes the NULL part is your option on the local computer. > > Best regards > > Meinolf Weber > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > no rights. > > > Hello Jeff, > > > > No, this can't help you, because the machine is a member server not a > > domain controller. The DSRM you only have on domain controllers not on > > member servers. > > > > Best regards > > > > Meinolf Weber > > Disclaimer: This posting is provided "AS IS" with no warranties, and > > confers > > no rights. > >> Can anyone tell me if the instructions in the following article, > >> under step 3 in regards to the server "null" value is what I'm > >> looking for? > >> > >> http://support.microsoft.com/kb/322672/en-us > >> > >> "Jeff" wrote: > >> > >>> Hello everyone, > >>> > >>> I'm trying to reset the password for just the recovery console of an > >>> application server. This server is on an Active Directory network > >>> but is not a domain controller and is a 2003 SP2 server. I found > >>> articles/info about setting the Directory Services Restore password, > >>> but nothing on resetting the local administrator password. The > >>> local admin listed on the machine in Local Users and Groupds is the > >>> domain administrator account, but not the local administrator. > >>> > >>> I had an issue with a corrupted system file or registry hive and > >>> wasn't able to log on to the recovery console using the domain admin > >>> password or the old local admin password that I had on file. (thank > >>> goodness that I was able to degrade a RAID 1 array and boot off of a > >>> single drive) > >>> > >>> Any help would be greatly appreciated. > >>> > >>> -- Thanks, Jeff > >>> > > >
Guest Iain Posted October 10, 2007 Posted October 10, 2007 RE: Reset Recovery console password If Microsoft advertised a backdoor method to get round security and change unknown administrator passwords easily their systems wouldn't be secure. You have a few options: 1. Support call to Microsoft or 3rd party recovery specialist 2. Locksmith, which is part of Microsoft's newly aquired Desktop Optimisation Pack (Formerly Sysinternals Adminpak) 3. 3rd party free tools such as: http://home.eunet.no/~pnordahl/ntpasswd/ You may have driver issues with the third option, which ultimately risk data consistency. Any use of these tools is at your own risk. If the data is importatnt a support call to Microsoft is best. These were a fixed rate of £200ish last time I checked. Iain. "Jeff" wrote: > Thanks for letting me know. I gave this a shot on the local machine and can > access the NTDSUTIL application, but received an error message (posted above > too): > > Setting password failed. > WIN32 Error Code: 0x32 > Error Message: The request is not supported. > > > Perhaps this is because this is a member server and not a DC? Any ideas? > > I'm surprised that this topic isn't documented somewhere. I can't be the > only person who's tried to use the recovery console to repair a system and > had lost the original password. Better yet, if there was a security breach > and an admin wanted to reset all the recovery console passwords (especially > if they were left as 'blank'). > > -- > Thanks, Jeff > > > "Meinolf Weber" wrote: > > > Hello Jeff, > > > > Sorry did a mistake, yes the NULL part is your option on the local computer. > > > > Best regards > > > > Meinolf Weber > > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > > no rights. > > > > > Hello Jeff, > > > > > > No, this can't help you, because the machine is a member server not a > > > domain controller. The DSRM you only have on domain controllers not on > > > member servers. > > > > > > Best regards > > > > > > Meinolf Weber > > > Disclaimer: This posting is provided "AS IS" with no warranties, and > > > confers > > > no rights. > > >> Can anyone tell me if the instructions in the following article, > > >> under step 3 in regards to the server "null" value is what I'm > > >> looking for? > > >> > > >> http://support.microsoft.com/kb/322672/en-us > > >> > > >> "Jeff" wrote: > > >> > > >>> Hello everyone, > > >>> > > >>> I'm trying to reset the password for just the recovery console of an > > >>> application server. This server is on an Active Directory network > > >>> but is not a domain controller and is a 2003 SP2 server. I found > > >>> articles/info about setting the Directory Services Restore password, > > >>> but nothing on resetting the local administrator password. The > > >>> local admin listed on the machine in Local Users and Groupds is the > > >>> domain administrator account, but not the local administrator. > > >>> > > >>> I had an issue with a corrupted system file or registry hive and > > >>> wasn't able to log on to the recovery console using the domain admin > > >>> password or the old local admin password that I had on file. (thank > > >>> goodness that I was able to degrade a RAID 1 array and boot off of a > > >>> single drive) > > >>> > > >>> Any help would be greatly appreciated. > > >>> > > >>> -- Thanks, Jeff > > >>> > > > > > >
Guest Jeff Posted October 10, 2007 Posted October 10, 2007 RE: Reset Recovery console password I'm not looking for a backdoor method of changing adminstrator passwords or getting around security, I'm talking about resetting a password on the system for legitimate administrators of the system (like me). While I have the local administrator password from when I originally installed the machine, this doesn't work under the recovery console. So, I need to reset it. The method is by using the NTDSUTIL program, which allows you to reset the DSRM password for any server on the network using a value of "server null" which is the local machine - this is supposed to allow you to reset the recovery console password for the local machine, even if not a DC. And there is a KB article on it that I found, it is listed above in one of my previous posts, hence the error message. -- Thanks, Jeff "Iain" wrote: > If Microsoft advertised a backdoor method to get round security and change > unknown administrator passwords easily their systems wouldn't be secure. > > You have a few options: > > 1. Support call to Microsoft or 3rd party recovery specialist > 2. Locksmith, which is part of Microsoft's newly aquired Desktop > Optimisation Pack (Formerly Sysinternals Adminpak) > 3. 3rd party free tools such as: http://home.eunet.no/~pnordahl/ntpasswd/ > > You may have driver issues with the third option, which ultimately risk data > consistency. > > Any use of these tools is at your own risk. If the data is importatnt a > support call to Microsoft is best. These were a fixed rate of £200ish last > time I checked. > > Iain. > > > "Jeff" wrote: > > > Thanks for letting me know. I gave this a shot on the local machine and can > > access the NTDSUTIL application, but received an error message (posted above > > too): > > > > Setting password failed. > > WIN32 Error Code: 0x32 > > Error Message: The request is not supported. > > > > > > Perhaps this is because this is a member server and not a DC? Any ideas? > > > > I'm surprised that this topic isn't documented somewhere. I can't be the > > only person who's tried to use the recovery console to repair a system and > > had lost the original password. Better yet, if there was a security breach > > and an admin wanted to reset all the recovery console passwords (especially > > if they were left as 'blank'). > > > > -- > > Thanks, Jeff > > > > > > "Meinolf Weber" wrote: > > > > > Hello Jeff, > > > > > > Sorry did a mistake, yes the NULL part is your option on the local computer. > > > > > > Best regards > > > > > > Meinolf Weber > > > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > > > no rights. > > > > > > > Hello Jeff, > > > > > > > > No, this can't help you, because the machine is a member server not a > > > > domain controller. The DSRM you only have on domain controllers not on > > > > member servers. > > > > > > > > Best regards > > > > > > > > Meinolf Weber > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and > > > > confers > > > > no rights. > > > >> Can anyone tell me if the instructions in the following article, > > > >> under step 3 in regards to the server "null" value is what I'm > > > >> looking for? > > > >> > > > >> http://support.microsoft.com/kb/322672/en-us > > > >> > > > >> "Jeff" wrote: > > > >> > > > >>> Hello everyone, > > > >>> > > > >>> I'm trying to reset the password for just the recovery console of an > > > >>> application server. This server is on an Active Directory network > > > >>> but is not a domain controller and is a 2003 SP2 server. I found > > > >>> articles/info about setting the Directory Services Restore password, > > > >>> but nothing on resetting the local administrator password. The > > > >>> local admin listed on the machine in Local Users and Groupds is the > > > >>> domain administrator account, but not the local administrator. > > > >>> > > > >>> I had an issue with a corrupted system file or registry hive and > > > >>> wasn't able to log on to the recovery console using the domain admin > > > >>> password or the old local admin password that I had on file. (thank > > > >>> goodness that I was able to degrade a RAID 1 array and boot off of a > > > >>> single drive) > > > >>> > > > >>> Any help would be greatly appreciated. > > > >>> > > > >>> -- Thanks, Jeff > > > >>> > > > > > > > > >
Guest Iain Posted October 10, 2007 Posted October 10, 2007 RE: Reset Recovery console password Hi Jeff, Your looking in the wrong place here. NTDSUTIL is for maintaining Active Directory, Domain Controllers only. DSRM is Directory Services Recovery Mode, which is Active Directory Holders only, i.e. Domain Controllers. Although Directory Services Restore Mode is a Windows boot option, it is useless unless your Server is a Domain Controller which your's is not. Server Null option just specifies you want to modify the local server Active Directory partion. The tools you require need to modify the encrypted SAM passwords on the local server. The options I have supplied will provide this facility. The remote console should be available for the local administrator, although it may be possible to disable this. You're post is slightly confusing. Do you have normal access to the server? If so you can change it from the server as per normal. If not these tools are designed for disaster recovery scenarios when normal operation is not available. There are policy options that set the levels of access on the recovery console, perhaps this is what you should be looking for? "Jeff" wrote: > I'm not looking for a backdoor method of changing adminstrator passwords or > getting around security, I'm talking about resetting a password on the system > for legitimate administrators of the system (like me). > > While I have the local administrator password from when I originally > installed the machine, this doesn't work under the recovery console. So, I > need to reset it. > > The method is by using the NTDSUTIL program, which allows you to reset the > DSRM password for any server on the network using a value of "server null" > which is the local machine - this is supposed to allow you to reset the > recovery console password for the local machine, even if not a DC. And there > is a KB article on it that I found, it is listed above in one of my previous > posts, hence the error message. > > -- > Thanks, Jeff > > > "Iain" wrote: > > > If Microsoft advertised a backdoor method to get round security and change > > unknown administrator passwords easily their systems wouldn't be secure. > > > > You have a few options: > > > > 1. Support call to Microsoft or 3rd party recovery specialist > > 2. Locksmith, which is part of Microsoft's newly aquired Desktop > > Optimisation Pack (Formerly Sysinternals Adminpak) > > 3. 3rd party free tools such as: http://home.eunet.no/~pnordahl/ntpasswd/ > > > > You may have driver issues with the third option, which ultimately risk data > > consistency. > > > > Any use of these tools is at your own risk. If the data is importatnt a > > support call to Microsoft is best. These were a fixed rate of £200ish last > > time I checked. > > > > Iain. > > > > > > "Jeff" wrote: > > > > > Thanks for letting me know. I gave this a shot on the local machine and can > > > access the NTDSUTIL application, but received an error message (posted above > > > too): > > > > > > Setting password failed. > > > WIN32 Error Code: 0x32 > > > Error Message: The request is not supported. > > > > > > > > > Perhaps this is because this is a member server and not a DC? Any ideas? > > > > > > I'm surprised that this topic isn't documented somewhere. I can't be the > > > only person who's tried to use the recovery console to repair a system and > > > had lost the original password. Better yet, if there was a security breach > > > and an admin wanted to reset all the recovery console passwords (especially > > > if they were left as 'blank'). > > > > > > -- > > > Thanks, Jeff > > > > > > > > > "Meinolf Weber" wrote: > > > > > > > Hello Jeff, > > > > > > > > Sorry did a mistake, yes the NULL part is your option on the local computer. > > > > > > > > Best regards > > > > > > > > Meinolf Weber > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > > > > no rights. > > > > > > > > > Hello Jeff, > > > > > > > > > > No, this can't help you, because the machine is a member server not a > > > > > domain controller. The DSRM you only have on domain controllers not on > > > > > member servers. > > > > > > > > > > Best regards > > > > > > > > > > Meinolf Weber > > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and > > > > > confers > > > > > no rights. > > > > >> Can anyone tell me if the instructions in the following article, > > > > >> under step 3 in regards to the server "null" value is what I'm > > > > >> looking for? > > > > >> > > > > >> http://support.microsoft.com/kb/322672/en-us > > > > >> > > > > >> "Jeff" wrote: > > > > >> > > > > >>> Hello everyone, > > > > >>> > > > > >>> I'm trying to reset the password for just the recovery console of an > > > > >>> application server. This server is on an Active Directory network > > > > >>> but is not a domain controller and is a 2003 SP2 server. I found > > > > >>> articles/info about setting the Directory Services Restore password, > > > > >>> but nothing on resetting the local administrator password. The > > > > >>> local admin listed on the machine in Local Users and Groupds is the > > > > >>> domain administrator account, but not the local administrator. > > > > >>> > > > > >>> I had an issue with a corrupted system file or registry hive and > > > > >>> wasn't able to log on to the recovery console using the domain admin > > > > >>> password or the old local admin password that I had on file. (thank > > > > >>> goodness that I was able to degrade a RAID 1 array and boot off of a > > > > >>> single drive) > > > > >>> > > > > >>> Any help would be greatly appreciated. > > > > >>> > > > > >>> -- Thanks, Jeff > > > > >>> > > > > > > > > > > > >
Guest Jeff Posted October 10, 2007 Posted October 10, 2007 RE: Reset Recovery console password Iain, I have normal access to the server now - I am rebuilding a mirrored set of hard drives after discovering that I could degrade the array, pull out one of the disks and boot off of a disk with a good copy of a system file (now the array is rebuilding b/c the hard drive is still good). The server went down over the weekend and wouldn't boot saying that a system file was not found. I had created a disk for the Automated System Recovery, but for some reason, this disk was not being read by Windows Setup. (so much for that option) So, I booted into the Recovery Console to restore the system file. Unfortunately, the local admin password I had did not work. In my Active Directory domain, I have renamed the domain administrator account via group policy and all servers also have their local administrator account renamed to the domain admin username. This may be the reason why the password doesn't work - password is right, but maybe Recovery Console is looking for "Administrator"? So if I just reset the local administrator password via Local Users & Groups/Computer Mgmt MMC, this should allow me access via recovery console? Because I have normal access, I turned the feature on to allow automatic logins via group policy so if need be I can get into the recovery console now, because that server is back on the network and has received the updated group policy. I'd rather have it password protected though, of course. -- Thanks, Jeff "Iain" wrote: > Hi Jeff, > > Your looking in the wrong place here. NTDSUTIL is for maintaining Active > Directory, Domain Controllers only. > > DSRM is Directory Services Recovery Mode, which is Active Directory Holders > only, i.e. Domain Controllers. > > Although Directory Services Restore Mode is a Windows boot option, it is > useless unless your Server is a Domain Controller which your's is not. > > Server Null option just specifies you want to modify the local server Active > Directory partion. > > The tools you require need to modify the encrypted SAM passwords on the > local server. The options I have supplied will provide this facility. > > The remote console should be available for the local administrator, although > it may be possible to disable this. > > You're post is slightly confusing. Do you have normal access to the server? > If so you can change it from the server as per normal. If not these tools > are designed for disaster recovery scenarios when normal operation is not > available. > > There are policy options that set the levels of access on the recovery > console, perhaps this is what you should be looking for? > > "Jeff" wrote: > > > I'm not looking for a backdoor method of changing adminstrator passwords or > > getting around security, I'm talking about resetting a password on the system > > for legitimate administrators of the system (like me). > > > > While I have the local administrator password from when I originally > > installed the machine, this doesn't work under the recovery console. So, I > > need to reset it. > > > > The method is by using the NTDSUTIL program, which allows you to reset the > > DSRM password for any server on the network using a value of "server null" > > which is the local machine - this is supposed to allow you to reset the > > recovery console password for the local machine, even if not a DC. And there > > is a KB article on it that I found, it is listed above in one of my previous > > posts, hence the error message. > > > > -- > > Thanks, Jeff > > > > > > "Iain" wrote: > > > > > If Microsoft advertised a backdoor method to get round security and change > > > unknown administrator passwords easily their systems wouldn't be secure. > > > > > > You have a few options: > > > > > > 1. Support call to Microsoft or 3rd party recovery specialist > > > 2. Locksmith, which is part of Microsoft's newly aquired Desktop > > > Optimisation Pack (Formerly Sysinternals Adminpak) > > > 3. 3rd party free tools such as: http://home.eunet.no/~pnordahl/ntpasswd/ > > > > > > You may have driver issues with the third option, which ultimately risk data > > > consistency. > > > > > > Any use of these tools is at your own risk. If the data is importatnt a > > > support call to Microsoft is best. These were a fixed rate of £200ish last > > > time I checked. > > > > > > Iain. > > > > > > > > > "Jeff" wrote: > > > > > > > Thanks for letting me know. I gave this a shot on the local machine and can > > > > access the NTDSUTIL application, but received an error message (posted above > > > > too): > > > > > > > > Setting password failed. > > > > WIN32 Error Code: 0x32 > > > > Error Message: The request is not supported. > > > > > > > > > > > > Perhaps this is because this is a member server and not a DC? Any ideas? > > > > > > > > I'm surprised that this topic isn't documented somewhere. I can't be the > > > > only person who's tried to use the recovery console to repair a system and > > > > had lost the original password. Better yet, if there was a security breach > > > > and an admin wanted to reset all the recovery console passwords (especially > > > > if they were left as 'blank'). > > > > > > > > -- > > > > Thanks, Jeff > > > > > > > > > > > > "Meinolf Weber" wrote: > > > > > > > > > Hello Jeff, > > > > > > > > > > Sorry did a mistake, yes the NULL part is your option on the local computer. > > > > > > > > > > Best regards > > > > > > > > > > Meinolf Weber > > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > > > > > no rights. > > > > > > > > > > > Hello Jeff, > > > > > > > > > > > > No, this can't help you, because the machine is a member server not a > > > > > > domain controller. The DSRM you only have on domain controllers not on > > > > > > member servers. > > > > > > > > > > > > Best regards > > > > > > > > > > > > Meinolf Weber > > > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and > > > > > > confers > > > > > > no rights. > > > > > >> Can anyone tell me if the instructions in the following article, > > > > > >> under step 3 in regards to the server "null" value is what I'm > > > > > >> looking for? > > > > > >> > > > > > >> http://support.microsoft.com/kb/322672/en-us > > > > > >> > > > > > >> "Jeff" wrote: > > > > > >> > > > > > >>> Hello everyone, > > > > > >>> > > > > > >>> I'm trying to reset the password for just the recovery console of an > > > > > >>> application server. This server is on an Active Directory network > > > > > >>> but is not a domain controller and is a 2003 SP2 server. I found > > > > > >>> articles/info about setting the Directory Services Restore password, > > > > > >>> but nothing on resetting the local administrator password. The > > > > > >>> local admin listed on the machine in Local Users and Groupds is the > > > > > >>> domain administrator account, but not the local administrator. > > > > > >>> > > > > > >>> I had an issue with a corrupted system file or registry hive and > > > > > >>> wasn't able to log on to the recovery console using the domain admin > > > > > >>> password or the old local admin password that I had on file. (thank > > > > > >>> goodness that I was able to degrade a RAID 1 array and boot off of a > > > > > >>> single drive) > > > > > >>> > > > > > >>> Any help would be greatly appreciated. > > > > > >>> > > > > > >>> -- Thanks, Jeff > > > > > >>> > > > > > > > > > > > > > > >
Guest Jeff Posted October 10, 2007 Posted October 10, 2007 RE: Reset Recovery console password Iain, I have normal access to the server now - I am rebuilding a mirrored set of hard drives after discovering that I could degrade the array, pull out one of the disks and boot off of a disk with a good copy of a system file (now the array is rebuilding b/c the hard drive is still good). The server went down over the weekend and wouldn't boot saying that a system file was not found. I had created a disk for the Automated System Recovery, but for some reason, this disk was not being read by Windows Setup. (so much for that option) So, I booted into the Recovery Console to restore the system file. Unfortunately, the local admin password I had did not work. In my Active Directory domain, I have renamed the domain administrator account via group policy and all servers also have their local administrator account renamed to the domain admin username. This may be the reason why the password doesn't work - password is right, but maybe Recovery Console is looking for "Administrator"? So if I just reset the local administrator password via Local Users & Groups/Computer Mgmt MMC, this should allow me access via recovery console? Because I have normal access, I turned the feature on to allow automatic logins via group policy so if need be I can get into the recovery console now, because that server is back on the network and has received the updated group policy. I'd rather have it password protected though, of course. -- Thanks, Jeff "Iain" wrote: > Hi Jeff, > > Your looking in the wrong place here. NTDSUTIL is for maintaining Active > Directory, Domain Controllers only. > > DSRM is Directory Services Recovery Mode, which is Active Directory Holders > only, i.e. Domain Controllers. > > Although Directory Services Restore Mode is a Windows boot option, it is > useless unless your Server is a Domain Controller which your's is not. > > Server Null option just specifies you want to modify the local server Active > Directory partion. > > The tools you require need to modify the encrypted SAM passwords on the > local server. The options I have supplied will provide this facility. > > The remote console should be available for the local administrator, although > it may be possible to disable this. > > You're post is slightly confusing. Do you have normal access to the server? > If so you can change it from the server as per normal. If not these tools > are designed for disaster recovery scenarios when normal operation is not > available. > > There are policy options that set the levels of access on the recovery > console, perhaps this is what you should be looking for? > > "Jeff" wrote: > > > I'm not looking for a backdoor method of changing adminstrator passwords or > > getting around security, I'm talking about resetting a password on the system > > for legitimate administrators of the system (like me). > > > > While I have the local administrator password from when I originally > > installed the machine, this doesn't work under the recovery console. So, I > > need to reset it. > > > > The method is by using the NTDSUTIL program, which allows you to reset the > > DSRM password for any server on the network using a value of "server null" > > which is the local machine - this is supposed to allow you to reset the > > recovery console password for the local machine, even if not a DC. And there > > is a KB article on it that I found, it is listed above in one of my previous > > posts, hence the error message. > > > > -- > > Thanks, Jeff > > > > > > "Iain" wrote: > > > > > If Microsoft advertised a backdoor method to get round security and change > > > unknown administrator passwords easily their systems wouldn't be secure. > > > > > > You have a few options: > > > > > > 1. Support call to Microsoft or 3rd party recovery specialist > > > 2. Locksmith, which is part of Microsoft's newly aquired Desktop > > > Optimisation Pack (Formerly Sysinternals Adminpak) > > > 3. 3rd party free tools such as: http://home.eunet.no/~pnordahl/ntpasswd/ > > > > > > You may have driver issues with the third option, which ultimately risk data > > > consistency. > > > > > > Any use of these tools is at your own risk. If the data is importatnt a > > > support call to Microsoft is best. These were a fixed rate of £200ish last > > > time I checked. > > > > > > Iain. > > > > > > > > > "Jeff" wrote: > > > > > > > Thanks for letting me know. I gave this a shot on the local machine and can > > > > access the NTDSUTIL application, but received an error message (posted above > > > > too): > > > > > > > > Setting password failed. > > > > WIN32 Error Code: 0x32 > > > > Error Message: The request is not supported. > > > > > > > > > > > > Perhaps this is because this is a member server and not a DC? Any ideas? > > > > > > > > I'm surprised that this topic isn't documented somewhere. I can't be the > > > > only person who's tried to use the recovery console to repair a system and > > > > had lost the original password. Better yet, if there was a security breach > > > > and an admin wanted to reset all the recovery console passwords (especially > > > > if they were left as 'blank'). > > > > > > > > -- > > > > Thanks, Jeff > > > > > > > > > > > > "Meinolf Weber" wrote: > > > > > > > > > Hello Jeff, > > > > > > > > > > Sorry did a mistake, yes the NULL part is your option on the local computer. > > > > > > > > > > Best regards > > > > > > > > > > Meinolf Weber > > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > > > > > no rights. > > > > > > > > > > > Hello Jeff, > > > > > > > > > > > > No, this can't help you, because the machine is a member server not a > > > > > > domain controller. The DSRM you only have on domain controllers not on > > > > > > member servers. > > > > > > > > > > > > Best regards > > > > > > > > > > > > Meinolf Weber > > > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and > > > > > > confers > > > > > > no rights. > > > > > >> Can anyone tell me if the instructions in the following article, > > > > > >> under step 3 in regards to the server "null" value is what I'm > > > > > >> looking for? > > > > > >> > > > > > >> http://support.microsoft.com/kb/322672/en-us > > > > > >> > > > > > >> "Jeff" wrote: > > > > > >> > > > > > >>> Hello everyone, > > > > > >>> > > > > > >>> I'm trying to reset the password for just the recovery console of an > > > > > >>> application server. This server is on an Active Directory network > > > > > >>> but is not a domain controller and is a 2003 SP2 server. I found > > > > > >>> articles/info about setting the Directory Services Restore password, > > > > > >>> but nothing on resetting the local administrator password. The > > > > > >>> local admin listed on the machine in Local Users and Groupds is the > > > > > >>> domain administrator account, but not the local administrator. > > > > > >>> > > > > > >>> I had an issue with a corrupted system file or registry hive and > > > > > >>> wasn't able to log on to the recovery console using the domain admin > > > > > >>> password or the old local admin password that I had on file. (thank > > > > > >>> goodness that I was able to degrade a RAID 1 array and boot off of a > > > > > >>> single drive) > > > > > >>> > > > > > >>> Any help would be greatly appreciated. > > > > > >>> > > > > > >>> -- Thanks, Jeff > > > > > >>> > > > > > > > > > > > > > > >
Guest Iain Posted October 10, 2007 Posted October 10, 2007 RE: Reset Recovery console password I think it's always the local admin. A/D isn't available in recovery mode and I doubt cached credentials would work. If the local admin account is changed from Administrator this may be an issue. Although it is best practice there are a number of knowledge base articles where this causes problems. Local admin will work, best to test and always keep a record of the local admin passwords on all servers. "Jeff" wrote: > Iain, > > I have normal access to the server now - I am rebuilding a mirrored set of > hard drives after discovering that I could degrade the array, pull out one of > the disks and boot off of a disk with a good copy of a system file (now the > array is rebuilding b/c the hard drive is still good). The server went down > over the weekend and wouldn't boot saying that a system file was not found. > I had created a disk for the Automated System Recovery, but for some reason, > this disk was not being read by Windows Setup. (so much for that option) > > So, I booted into the Recovery Console to restore the system file. > Unfortunately, the local admin password I had did not work. In my Active > Directory domain, I have renamed the domain administrator account via group > policy and all servers also have their local administrator account renamed to > the domain admin username. This may be the reason why the password doesn't > work - password is right, but maybe Recovery Console is looking for > "Administrator"? > > So if I just reset the local administrator password via Local Users & > Groups/Computer Mgmt MMC, this should allow me access via recovery console? > > Because I have normal access, I turned the feature on to allow automatic > logins via group policy so if need be I can get into the recovery console > now, because that server is back on the network and has received the updated > group policy. I'd rather have it password protected though, of course. > > -- > Thanks, Jeff > > > "Iain" wrote: > > > Hi Jeff, > > > > Your looking in the wrong place here. NTDSUTIL is for maintaining Active > > Directory, Domain Controllers only. > > > > DSRM is Directory Services Recovery Mode, which is Active Directory Holders > > only, i.e. Domain Controllers. > > > > Although Directory Services Restore Mode is a Windows boot option, it is > > useless unless your Server is a Domain Controller which your's is not. > > > > Server Null option just specifies you want to modify the local server Active > > Directory partion. > > > > The tools you require need to modify the encrypted SAM passwords on the > > local server. The options I have supplied will provide this facility. > > > > The remote console should be available for the local administrator, although > > it may be possible to disable this. > > > > You're post is slightly confusing. Do you have normal access to the server? > > If so you can change it from the server as per normal. If not these tools > > are designed for disaster recovery scenarios when normal operation is not > > available. > > > > There are policy options that set the levels of access on the recovery > > console, perhaps this is what you should be looking for? > > > > "Jeff" wrote: > > > > > I'm not looking for a backdoor method of changing adminstrator passwords or > > > getting around security, I'm talking about resetting a password on the system > > > for legitimate administrators of the system (like me). > > > > > > While I have the local administrator password from when I originally > > > installed the machine, this doesn't work under the recovery console. So, I > > > need to reset it. > > > > > > The method is by using the NTDSUTIL program, which allows you to reset the > > > DSRM password for any server on the network using a value of "server null" > > > which is the local machine - this is supposed to allow you to reset the > > > recovery console password for the local machine, even if not a DC. And there > > > is a KB article on it that I found, it is listed above in one of my previous > > > posts, hence the error message. > > > > > > -- > > > Thanks, Jeff > > > > > > > > > "Iain" wrote: > > > > > > > If Microsoft advertised a backdoor method to get round security and change > > > > unknown administrator passwords easily their systems wouldn't be secure. > > > > > > > > You have a few options: > > > > > > > > 1. Support call to Microsoft or 3rd party recovery specialist > > > > 2. Locksmith, which is part of Microsoft's newly aquired Desktop > > > > Optimisation Pack (Formerly Sysinternals Adminpak) > > > > 3. 3rd party free tools such as: http://home.eunet.no/~pnordahl/ntpasswd/ > > > > > > > > You may have driver issues with the third option, which ultimately risk data > > > > consistency. > > > > > > > > Any use of these tools is at your own risk. If the data is importatnt a > > > > support call to Microsoft is best. These were a fixed rate of £200ish last > > > > time I checked. > > > > > > > > Iain. > > > > > > > > > > > > "Jeff" wrote: > > > > > > > > > Thanks for letting me know. I gave this a shot on the local machine and can > > > > > access the NTDSUTIL application, but received an error message (posted above > > > > > too): > > > > > > > > > > Setting password failed. > > > > > WIN32 Error Code: 0x32 > > > > > Error Message: The request is not supported. > > > > > > > > > > > > > > > Perhaps this is because this is a member server and not a DC? Any ideas? > > > > > > > > > > I'm surprised that this topic isn't documented somewhere. I can't be the > > > > > only person who's tried to use the recovery console to repair a system and > > > > > had lost the original password. Better yet, if there was a security breach > > > > > and an admin wanted to reset all the recovery console passwords (especially > > > > > if they were left as 'blank'). > > > > > > > > > > -- > > > > > Thanks, Jeff > > > > > > > > > > > > > > > "Meinolf Weber" wrote: > > > > > > > > > > > Hello Jeff, > > > > > > > > > > > > Sorry did a mistake, yes the NULL part is your option on the local computer. > > > > > > > > > > > > Best regards > > > > > > > > > > > > Meinolf Weber > > > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > > > > > > no rights. > > > > > > > > > > > > > Hello Jeff, > > > > > > > > > > > > > > No, this can't help you, because the machine is a member server not a > > > > > > > domain controller. The DSRM you only have on domain controllers not on > > > > > > > member servers. > > > > > > > > > > > > > > Best regards > > > > > > > > > > > > > > Meinolf Weber > > > > > > > Disclaimer: This posting is provided "AS IS" with no warranties, and > > > > > > > confers > > > > > > > no rights. > > > > > > >> Can anyone tell me if the instructions in the following article, > > > > > > >> under step 3 in regards to the server "null" value is what I'm > > > > > > >> looking for? > > > > > > >> > > > > > > >> http://support.microsoft.com/kb/322672/en-us > > > > > > >> > > > > > > >> "Jeff" wrote: > > > > > > >> > > > > > > >>> Hello everyone, > > > > > > >>> > > > > > > >>> I'm trying to reset the password for just the recovery console of an > > > > > > >>> application server. This server is on an Active Directory network > > > > > > >>> but is not a domain controller and is a 2003 SP2 server. I found > > > > > > >>> articles/info about setting the Directory Services Restore password, > > > > > > >>> but nothing on resetting the local administrator password. The > > > > > > >>> local admin listed on the machine in Local Users and Groupds is the > > > > > > >>> domain administrator account, but not the local administrator. > > > > > > >>> > > > > > > >>> I had an issue with a corrupted system file or registry hive and > > > > > > >>> wasn't able to log on to the recovery console using the domain admin > > > > > > >>> password or the old local admin password that I had on file. (thank > > > > > > >>> goodness that I was able to degrade a RAID 1 array and boot off of a > > > > > > >>> single drive) > > > > > > >>> > > > > > > >>> Any help would be greatly appreciated. > > > > > > >>> > > > > > > >>> -- Thanks, Jeff > > > > > > >>> > > > > > > > > > > > > > > > > > >
Recommended Posts