Reset Windows Password

At a glance#

• Purpose: Reset a lost local administrator password using Windows installation media and the Utility Manager replacement method.
• Applies to: Windows Server 2012 R2 through 2022, Windows 10 and 11.
• Risk: High — requires boot media, downtime, and physical or console access.
• Time: About 45 minutes.

Overview#

Windows presents an accessibility button (Utility Manager) on the login screen, and it runs as SYSTEM before anyone has authenticated. Temporarily replacing utilman.exe with cmd.exe therefore gives a SYSTEM-level command prompt at the login screen, from which a password can be reset.

The technique needs boot media and console access. It cannot be done remotely.

Warning: This is why physical or console access to an unencrypted Windows machine is equivalent to full administrative control. The mitigation is BitLocker — with full-disk encryption enabled, the offline filesystem cannot be modified from WinPE. Any server holding sensitive data should have it enabled.

Warning: Step 9 is not optional. Leaving cmd.exe in place of utilman.exe leaves a permanent SYSTEM-level backdoor on the login screen, reachable by anyone who can see the console.

Before you start#

• Windows ISO matching the installed version, attached as boot media.
• VM console or physical access.
• A maintenance window — the machine reboots several times.
• A VM snapshot.
• For VMware VMs using the PVSCSI controller, the VMware Tools ISO available (see step 4).

Note: For domain accounts this will not help — domain passwords live in Active Directory, not locally. Reset those through Active Directory Users and Computers on a domain controller.

Procedure#

1. Boot into the Windows installation environment#

1. Attach the Windows ISO and set the VM to boot from it.
2. Power on and boot from the ISO.
3. At the first Windows Setup screen, press Shift + F10.

A Command Prompt opens in the Windows Preinstallation Environment (WinPE).

2. Identify the Windows installation drive#

Drive letters in WinPE rarely match those in the installed OS — the Windows volume is often D: rather than C:.

Start DiskPart:

diskpart
list disk

If no disks appear, storage drivers are missing — go to step 4.

With disks visible, list the volumes:

list volume

Identify the volume holding Windows, usually the largest NTFS partition. If it has no letter, assign one:

select volume <number>
assign letter=D
exit

Confirm you have the right volume before continuing:

dir D:\Windows\System32\utilman.exe

If that file is not there, you have the wrong volume.

3. Load VMware PVSCSI drivers if no disks appear#

Only needed when DiskPart shows no disks — usually a VMware VM using the paravirtual SCSI controller, whose driver is not in the standard Windows install media.

1. Mount the VMware Tools ISO in the VM.
2. Load the driver, adjusting the drive letter and Windows version as needed:

drvload "E:\Program Files\VMware\VMware Tools\Drivers\pvscsi\Win10\amd64\pvscsi.inf"

1. Re-run DiskPart:

diskpart
list disk

The disk should now be visible. Return to step 2.

Note: The same problem during a fresh install is covered in Resolving "There are no fixed disks to show" in VMware with PVSCSI.

4. Replace utilman.exe with cmd.exe#

Back up the original first — this is what you restore in step 9:

move D:\Windows\System32\utilman.exe D:\Windows\System32\utilman.exe.bak

Put cmd.exe in its place:

copy D:\Windows\System32\cmd.exe D:\Windows\System32\utilman.exe

Reboot back into Windows:

wpeutil reboot

Detach the ISO as it reboots, or it will boot into setup again.

5. Open a command prompt from the login screen#

At the Windows login screen, click the Utility Manager icon — bottom-right, the accessibility symbol.

A Command Prompt opens instead, running as SYSTEM.

6. Reset the password or create an admin account#

To reset an existing local account directly:

net user Administrator NewStrongPassword123!

List local accounts first if you are unsure of the name:

net user

If the account is disabled or you would rather not disturb it, create a temporary administrator:

net user tempadmin NewStrongPassword123! /add
net localgroup administrators tempadmin /add

Note: If the built-in Administrator account is disabled, enable it with net user Administrator /active:yes.

Restart:

shutdown /r /t 0

7. Log in and confirm#

Log in with the reset or newly created account.

If you created a temporary admin, reset the original account's password properly:

Computer Management → Local Users and Groups → Users → right-click the account → Set Password.

8. Restore utilman.exe#

Do not skip this. Until it is done, the machine has an unauthenticated SYSTEM shell on its login screen.

1. Boot from the Windows ISO again.
2. Press Shift + F10.
3. Confirm the drive letter as in step 2, then restore the original:

copy /y D:\Windows\System32\utilman.exe.bak D:\Windows\System32\utilman.exe
del D:\Windows\System32\utilman.exe.bak

1. Reboot:

wpeutil reboot

9. Clean up#

Once the original account works, remove the temporary administrator:

net user tempadmin /delete

Record the new password in the team password manager.

Verification#

Work through all of these before considering the job done:

1. Log in with the reset account.
2. Confirm administrative rights — open an elevated Command Prompt.
3. Click the Utility Manager icon on the login screen. It must open the real accessibility tool, not a command prompt. If a command prompt appears, step 8 did not take effect.
4. Confirm the temporary account is gone:

net user

1. Check that services and applications started correctly after the reboots.

Troubleshooting#

Related#

• Resolving "There are no fixed disks to show" in VMware with PVSCSI
• Changing root password Ubuntu
• Changing root password Redhat