Log On Through the RC Without the Administrator Password

I recently discovered that you can log on to a Windows Server 2003 or Windows XP installation without knowing the Administrator password. All you need is a Windows 2000 Server CD-ROM. You use this CD-ROM to boot the computer, then use the Recovery Console (RC). Regardless of the local computer's Allow automatic administrative logon setting, you'll be able to log on without being prompted for a password. This is possible because of the different SAM database format. (For more information about this problem, see the Microsoft article "An Attacker with Physical Access to Your Computer May Be Able to Access Your Files and Other Data," http://support.microsoft.com/?kbid=818200.)

Although helpful in emergencies, the ability to log on through the RC without the Administrator password can be a security risk. Thus, in the computer's BIOS settings, you should disable booting from CDROMs and password-protect the settings. Alternatively, you can use Syskey to create a key that will allow you to boot your computer, then save this key to a floppy disk.

End of Article