IT guys: computer ADMIN question

cashflyer · 08-11-2007, 02:04 PM

OS= XP pro

One of my workers bought a used laptop. Although he is in the computer with an "administrator" level login, he seems to have limited access. This came to my attention while I was removing a lot of spyware from his computer.

In the control panel, remove programs window, many of the installed programs will not allow us to uninstall.

Also, when trying to change some of the settings on the computer I get a message that the "network administrator" has limited access.

Any ideas on a fix or workaround?

I guess we could format the drive, but since it is a used computer he does not have the master XP disk. (And no, he will not consider Linux.)

Thanks for your time and help.

masraum · 08-11-2007, 02:23 PM

a search on google returned this. I've used similar software to do the same to my own work laptop since they sometimes lock the darn thing down. These should work.

http://www.softwaretipsandtricks.com/forum/other-operating-systems/21512-crack-administrator-password.html

cashflyer · 03:04 PM

Several programs and attacks are mentioned on that page. Is there any one in particular that you have found best?

To make the challenge more interesting... the laptop will NOT allow the boot sequence to be set to boot from anything other than the hard drive. Also, it will not accept the F8 "safe mode" command - though I know a way around this.

slodave · slodave's Garage

Does he have to log onto the computer when it is first turned on. If so, does it want to log onto a domain?

Dave

Scott R · Scott R's Garage

The issue here is that this machine was at one time joined to a domain, and that domain had a security policy applied to this machine. My guess would be that you can look at the properties of "my computer" and see that it's still thinks in in a domain, or a three line login box when you start it up would indicate this as well.

If it still thinks it's in a domain, drop it into a workgroup, however make sure you have a working local admin account first. That should ditch the policy, if not you will need to remove the security template with secedit.

masraum · 08-11-2007, 08:36 PM

Quote:

Originally Posted by cashflyer

Several programs and attacks are mentioned on that page. Is there any one in particular that you have found best?

To make the challenge more interesting... the laptop will NOT allow the boot sequence to be set to boot from anything other than the hard drive.

Hmm, that's weird, so they have a password on the BIOS/CMOS settings? Or you can get into the BIOS/CMOS but can't edit?

I've got something burned to CD, but I don't remember what I've used, I looked at so many apps that are basically the same. Based on what you said above, the app that I used won't help since it relies on being able to boot from CD or floppy.

Oracle · 08-11-2007, 09:55 PM

You need to open up that Laptop and remove the CMOS battery so it defaults back to factory settings (all vendors have instructions on how to force a reset of the BIOS)
Then get a hold of a copy of a BART CD (If I had mine I'd send you an .iso image but I borrowed it), then boot from that CD and modify the SAM database then reboot from the hard drive and voila!

Good luck!

slodave · slodave's Garage

Quote:

Originally Posted by Oracle

You need to open up that Laptop and remove the CMOS battery so it defaults back to factory settings (all vendors have instructions on how to force a reset of the BIOS)
Then get a hold of a copy of a BART CD (If I had mine I'd send you an .iso image but I borrowed it), then boot from that CD and modify the SAM database then reboot from the hard drive and voila!

Good luck!

Removing the CMOS battery does not always work anymore. A lot of BIOS passwords are stored in NVRAM on the MB.

Dave

TibetanT · TibetanT's Garage

Well, first of all, I set the Administrator (username) profile on servers without the capabilities that most would expect. This is a security measure being used by many Fortune 500 companies.

So, what this means is, although you are logged into the computer as the Administrator, you really don't have the attributes.

What I would do is look at Documents and Settings, to get a list of all the users that have logged into the machine. Second, I would try and log in locally as an Administrator, rather than the Domain. If you can login locally as the Administrator, you may be able to fix your problems. Once logged into the machine as a local Administrator, setup a user with Administrator rights and keep that password written down somewhere safe. Like inside a safe.

Now, as far as Control Panel Add/Remove programs problems, when you go to uninstall an application, some of this crap that comes from the Internet MUST be connected to the Internet in order to uninstall. This is because Registry is looking for a string that lives on the Internet, at a URL, and only that string will trigger the uninstall to work and delete files on the machine.

Another trick, is to change the settings of the My Computer Properties to WORKGROUP. If you can successfully move from a Domain to the WORKGROUP then your login will stop getting those Network errors that you are seeing.
If you know anything about systems in a large configuration, the WORKGROUP was (in NT4.0 days) a stand-alone computer.

Hope this helps and good luck with hacking the XP laptop.

id10t · 08-12-2007, 05:49 AM

Format and reinstall....

cashflyer · 08-12-2007, 06:18 AM

Wow... some of this (most) if getting over my head.

Scott- I think I agree that this has to do with a security policy setting. The company is a major corporation (international) that sold the old computers to their employees on the cheap. I'm really surprised that they didn't wipe them before selling them, but it looks like all they did was delete company info and then send them out the door.

masraum- When the computer boots, I can go to the boot sequence list and choose to boot from CD - but it still just boots from hard disc. This prevents me from using boot disc methods.

Dave- The login screen has two lines; his name and password. No line for domain.

Tibetan- "Member of" is set to "workgroup", not "domain". Only two uses listed in D&S. Administrator, and Teddy (the owner). We do not know the Administrator password, so cannot login as the administrator.

For now, I'm holding off on both the cmos battery option and the format option.

Scott R · Scott R's Garage

Try this to get the admin password reset, it's a simple Linux boot floppy that allows you to rest the admin password.

http://home.eunet.no/~pnordahl/ntpasswd/

It may or may not work, depending on how tight the security is on the system. If that doesn't work you would need to use something like ERD commander, and it's not cheap.