Hidden Administrator Account?

[trents]

Ran into a problem last week that stumps me. Maybe someone can give me insight into what is going on.

I was asked by a small business to solve an administrator password problem on the bookkeeper's computer. As far as I know the several computers in this small business are on a peer to peer network and not managed by and active directory server.

The bookkeeper is a Standard user (no administrator privileges). Firefox wanted to do an update but when the update was attempted a window would pop up with the user name "Charlie" asking for the administrator's password. Well, Charlie entered what he remembered as the admin password but it was rejected. Charlie tried several other passwords recorded in their password book but to no avail.

At the Windows 7 log in screen there appears two choices: "Lucy" (the bookkeeper) and "Other". No "Charlie". No "Administrator".

Using a freeware password resetting utility that runs on a self-booting optical disk, I deleted all the passwords. Funny thing is, in the list of users in addition to "Administrator" and "Lucy" there was "Linda". Now Linda does not show up as a user choice in the Windows 7 log in screen. There was no "Charlie" in the user list displayed by the reset utility so I assumed that Charlie was synonymous with "Administrator". At any rate, I wiped all the passwords for all the users that did appear in the list: "Administrator," "Lucy," and "Linda". The utility told me the passwords had been successfully deleted.

I went back into Windows and as expected the machine booted right into Lucy's desktop, not prompting for a password (since it had been deleted). Okay, I thought, I just need to make Lucy administrator so I proceeded to Control Panel>User Accounts to arrange this but when I tried to change her from Standard to Administrator the old "Charlie" admin user popped up asking for a password. I thought okay, it's blank now so I just hit Enter key but it wouldn't accept it. I also tried all the other passwords everyone else had been trying. Back to square one.

It's as if there is a hidden or ghost administrator account somewhere that was not seen by the password removal utility I was using and that only shows in Windows when you try to do something that requires admin privileges.

IS the SAM corrupted?

I also used a password cracker to mine the system passwords but all it came up with was the one Lucy had been using that does not work for Charlie. The pw cracker said all the other passwords were blank.

Any help would be appreciated.

 

[bob4933]

Ive had it where when you upgrade windows, it'll have some database of previous accounts. Has this machine been updated at some point? Long lost registry entries may still be there.

 

[trents]

Ive had it where when you upgrade windows, it'll have some database of previous accounts. Has this machine been updated at some point? Long lost registry entries may still be there.

I don't think so but I'm not positive. It has an Athlon II 430 CPU in it (Dell machine) and I think it probably shipped with Windows 7 if I'm getting my generations right.

Well, now let me take that back. The Rana core Athon IIs came out in 2009 and that's the same year Windows 7 came out I think. Could have originally been loaded with Vista.

If so, what to do about it? Anything short of a clean reinstall of the OS and all software if no one can come up with the correct password? How about hacking the registry?

 

[wagex]

easiest way to reset charlie's password or make one up for it.
http://lifehacker.com/5612487/hack-the-sticky-keys-feature-to-reset-a-forgotten-windows-password

 

[Robert17]

You should be prompted for admin privileges when attempting to enter the registry as well. You can give it a try; if it works search for all instances of the user names and you'll quickly find out if there is a history of users and upgrades. Backtracking from the registry folders will tell you a lot.

 

[bob4933]

I don't think so but I'm not positive. It has an Athlon II 430 CPU in it (Dell machine) and I think it probably shipped with Windows 7 if I'm getting my generations right.

Well, now let me take that back. The Rana core Athon IIs came out in 2009 and that's the same year Windows 7 came out I think. Could have originally been loaded with Vista.

If so, what to do about it? Anything short of a clean reinstall of the OS and all software if no one can come up with the correct password? How about hacking the registry?

Barring the mild annoyance, is it worth your time? To get rid of past entries, you will need to access reg edit and sort that. THAT part im unsure how to do. You can obviously wipe the hard drive and reinstall OS if its prudent.

 

[trents]

easiest way to reset charlie's password or make one up for it.
http://lifehacker.com/5612487/hack-the-sticky-keys-feature-to-reset-a-forgotten-windows-password

Not sure that seems like it would accomplish anything I haven't already done another way. I'm just not able to access all the administrative accounts for some reason. Some of them seem to be hidden where the password resetters don't reach.

 

[trents]

Barring the mild annoyance, is it worth your time? To get rid of past entries, you will need to access reg edit and sort that. THAT part im unsure how to do. You can obviously wipe the hard drive and reinstall OS if its prudent.

Yeah, that's what I'm thinking. The bookkeeper found out since I started this undertaking that the online service she uses which formerly was compatible only with Firefox is now compatible with IE, which is up to date. So there is no urgent need to do a clean reinstall. One thing that's weird is that Firefox wouldn't update without Charlie's password while other things, like Java would.

 

[wagex]

Not sure that seems like it would accomplish anything I haven't already done another way. I'm just not able to access all the administrative accounts for some reason. Some of them seem to be hidden where the password resetters don't reach.

if windows is recognizing the account then it should. worth a shot atleast.

 

[Tokae]

You could also try a running http://ophcrack.sourceforge.net/ to see what accounts it finds. It does a pretty decent job of cracking passwords.

 

[trents]

You could also try a running http://ophcrack.sourceforge.net/ to see what accounts it finds. It does a pretty decent job of cracking passwords.

Did that already. It found the one password the bookkeeper is already using. There's another one somewhere for the "hidden" account.

 

[c627627]

When I read the words 'Hidden Administrator Account' I thought it was this, which I post in case the search engines hit this thread:

You may enable the hidden actual Administrator Account so that you can have ultimate Administrator privileges that surpass privileges that user accounts 'with Administrator Privileges' have. Start > All Programs > Accessories > Right click on Command Prompt > Run as administrator > Yes > net user administrator /active:yes

Log off your user account and log into the newly enabled real Administrator account.

 

[trents]

When I read the words 'Hidden Administrator Account' I thought it was this, which I post in case the search engines hit this thread:

You may enable the hidden actual Administrator Account so that you can have ultimate Administrator privileges that surpass privileges that user accounts 'with Administrator Privileges' have. Start > All Programs > Accessories > Right click on Command Prompt > Run as administrator > Yes > net user administrator /active:yes

Log off your user account and log into the newly enabled real Administrator account.

Tried that and it was a no go. You have to have administrator rights to run as administrator. That suggestion is begging the point. We don't know what the admin password is. That's the whole problem.

 

[trents]

Eureka! Solved!

The same third party software I used the other day to unsuccessfully blank the administrator account password also has the ability to elevate any user to administrator status. Lucy was just a standard user. So I used the program to elevate her to admin status. The first try at that didn't work but then I went back and elevated "Guest" to admin status and Lucy now has administrator privileges. Apparently, Windows was misreporting Lucy as a Standard user when she was really a Guest. There are still some unanswered questions about orphan/ghost accounts that persist on the machine but at least Lucy can do what she needs to do now in her profile.

By the way, here is t he software I used: http://pogostick.net/~pnh/ntpasswd/

And speaking of the orphan/ghost accounts that persist, bob4933 you were correct. There is evidence that someone apparently did an in place upgrade to Windows 7 and also that a Windows XP virtual machine was installed at some point.

 

[bob4933]

Cool, thanks for posting the fix. I've had that problem on computers where friends/family buy a used pc and the... "Genius" before didn't wipe the hard drive. Don't recall jumping through those admin hoops tho, thats good to know in the future.

 

[Audioaficionado]

If you use windows encryption on folders, doesn't resetting or deleting the account passwords also nuke the data more or less?

 

[bob4933]

If you use windows encryption on folders, doesn't resetting or deleting the account passwords also nuke the data more or less?

Nope

 

[Audioaficionado]

They still have to have a separate pass word from the account then?

 

[bob4933]

They still have to have a separate pass word from the account then?

I believe it simply removes the password on the files, would it not?

 

[Audioaficionado]

I've downloaded windows password apps and they had a warning about losing encrypted files/folders if you deleted a password before decrypting them. They would remain encrypted with no way to decrypt them.