Reset a Windows Password with SystemRescueCD

To reset Windows password using SystemRescueCD, boot the server from a live ISO, edit the offline local-account database, and set a new password from the Windows console. The recovery normally takes 10–20 minutes and does not require reinstalling Windows.

Prerequisites

• A Windows 10, Windows 11, or Windows Server VPS with a local account you own or administer. This method is not for Microsoft accounts, domain accounts, PINs, or accounts on a BitLocker-locked volume.
• Access to the VPSLake Windows RDP service, the VPSLake client area, and Virtualizor with permission to power-cycle the VPS, attach an ISO, and open VNC.
• The current amd64 SystemRescue ISO from the official download page, plus its published SHA256 checksum. A 64-bit Windows VPS needs the amd64 image.
• At least 2 GB of RAM for the default live boot and enough storage on the computer used to upload or attach the roughly 1.3 GB ISO. Keep a VPS snapshot or backup available before editing Windows registry hives.
• A strong, unique replacement password ready to enter at the Windows console. Do not put it in a command, screenshot, ticket, or shell history.

Only perform this recovery on a system you are authorized to administer. The offline SAM database controls local authentication, so treat the operation as a privileged account-recovery procedure.

Step 1: Download and verify SystemRescue

The checksum helps you avoid booting a damaged or altered rescue image.

Download the latest amd64 ISO and its matching .sha256 file from the official SystemRescue page. On a Windows computer, open PowerShell in the download folder and replace SYSTEMRESCUE_ISO with the actual ISO filename:

Get-FileHash .\SYSTEMRESCUE_ISO -Algorithm SHA256

Compare the displayed Hash value with the official checksum file. The check is successful when the complete values match:

Algorithm : SHA256
Hash      : MATCHES THE OFFICIAL SYSTEMRESCUE CHECKSUM
Path      : C:\Path\To\SYSTEMRESCUE_ISO

Step 2: Shut down Windows and boot the rescue ISO

The Windows volume must be fully offline before you write to its account hive.

If you can reach the VNC login screen, use its power menu to select Shut down. Otherwise open VPSLake client area → Services → your Windows VPS → Open VPS control panel → Power Control → Shutdown, and wait until the VPS is off. Do not use a forced reset while Windows is still running unless the guest is completely unresponsive.

Attach the image through Virtualizor → ISO/Media → Mount ISO, choose the verified SystemRescue ISO, and save the change. Set the next boot device to the virtual CD/DVD when Virtualizor provides that option, then open Virtualizor → VNC and select Power Control → Start or Reboot.

At the SystemRescue menu, accept the default amd64 entry and press Enter. Wait for the root shell; if a desktop starts, open a terminal. SystemRescue does not automatically mount your Windows partitions, which prevents accidental writes before you choose the correct volume.

Step 3: Find the Windows system partition

Linux names disks by device paths rather than Windows drive letters, so use the filesystem type and size to identify the correct volume.

Run:

lsblk -f

Find the large ntfs partition that contains the Windows installation. Do not choose the small EFI, Microsoft reserved, or recovery partition.

NAME  FSTYPE FSVER LABEL  SIZE MOUNTPOINTS
vda                         80G
├─vda1 vfat                 100M
├─vda2 ntfs          78.9G
└─vda3 ntfs                 900M

In this example, vda2 is the likely Windows partition. Record the complete partition name as WINDOWS_PARTITION; NVMe devices use names such as nvme0n1p3 rather than nvme0n13.

Step 4: Mount Windows and make a hive backup

The SAM file is inside the Windows configuration directory, and a local copy gives you a recovery point if you stop before writing changes.

Replace WINDOWS_PARTITION with the value from lsblk -f:

mkdir -p /mnt/windows
ntfs-3g -o rw /dev/WINDOWS_PARTITION /mnt/windows
test -f /mnt/windows/Windows/System32/config/SAM && echo "Windows SAM found"

Expected result:

Windows SAM found

Now copy the relevant hives into the live environment, which is normally memory-backed and disappears when you reboot:

cd /mnt/windows/Windows/System32/config
mkdir -p /root/windows-hive-backup
cp -a SAM SYSTEM SECURITY /root/windows-hive-backup/
ls -l /root/windows-hive-backup

You should see SAM, SYSTEM, and SECURITY in the listing. Keep the VPS snapshot as well; the temporary backup is not a substitute for a durable backup.

Step 5: Clear the local account password

chntpw edits the offline SAM record; it does not reveal the old password. The safest path is to clear the old value, sign in locally, and immediately create a strong replacement in Windows.

Confirm that the current SystemRescue image has the utility and list the accounts:

command -v chntpw
chntpw -l SAM

Expected output resembles:

/usr/bin/chntpw
RID: 01f4, Username: Administrator
RID: 03e8, Username: YOUR_USERNAME

Start the interactive editor:

chntpw -i SAM

At the prompts, choose Edit user data and passwords, select the intended account by the RID and username shown by chntpw -l, then choose Clear (blank) user password. Do not select Promote user or alter an account you cannot identify. Press q to leave the user menu, press q again to leave the main menu, and answer y when the program asks whether to write the changed hive.

The successful write confirmation is similar to this:

Hives that have changed:
 # Name
 0
Write hive files? (y/n) [n] : y

Step 6: Unmount the disk and return to Windows

Unmounting flushes the hive change and releases the NTFS volume before Windows opens it again.

Run:

cd /
sync
umount /mnt/windows

umount should return to the prompt without an error. Then use Virtualizor → ISO/Media → Detach/Unmount ISO, followed by Virtualizor → Power Control → Reboot. Keep VNC open so you can complete the first sign-in without depending on RDP.

Verify the recovered account

At the Windows sign-in screen in VNC, select the recovered local account and submit an empty password. As soon as Windows opens, press Ctrl+Alt+Delete, choose Change a password, leave the old-password field empty, and enter the new strong password twice.

If the secure screen is unavailable, use Start → Settings → Accounts → Sign-in options → Password → Change. Then disconnect VNC and start a new RDP connection using the local identity format SERVER_NAME\YOUR_USERNAME.

After signing in, open PowerShell and confirm the account identity:

whoami

Expected output:

SERVER_NAME\YOUR_USERNAME

Troubleshooting

NTFS volume is hibernated or the mount is read-only

Windows Fast Startup, hibernation, or an unclean shutdown left the filesystem in a state that is unsafe to modify. Boot Windows normally if possible, disable Fast Startup temporarily, choose Start → Power → Shut down, and retry; do not force a write mount or run repair tools just to bypass the warning.

Windows SAM found does not appear

The selected partition is probably the EFI, recovery, or data volume. Run lsblk -f again, unmount with umount /mnt/windows, and test the large NTFS partitions until the one containing Windows, Users, and Program Files is mounted.

chntpw: command not found

You may have booted an old or incomplete rescue image. Re-download the current amd64 ISO from the official SystemRescue download page, verify its checksum, and attach that image again; the current package set includes chntpw and the NTFS tools.

VNC accepts the blank password but RDP rejects it

Windows commonly blocks blank passwords for remote network logons. Set the real password at the VNC console first, then remove the saved entry under Control Panel → Credential Manager → Windows Credentials on the RDP client and reconnect with SERVER_NAME\YOUR_USERNAME.

Hardening after recovery

• Detach the rescue ISO so the VPS boots Windows on its next restart.
• Store the replacement password in a password manager and remove temporary copies from your workstation and console notes.
• Keep a current VPS snapshot and document the approved recovery process for the next administrator.
• If BitLocker is enabled, store its recovery key separately; an offline SAM editor cannot unlock an encrypted Windows volume without the key.

FAQ

Can SystemRescue reset a Microsoft account password?

No. SystemRescue changes the local SAM database, while a Microsoft account is managed by Microsoft’s online identity system. Use the account provider’s recovery process or sign in with an available local administrator.

Does this method work for an Active Directory account?

No. A domain account is validated by the domain controller, not solely by the local SAM hive. Ask a domain administrator to reset it through the approved domain-management tools.

Will clearing the password remove the user’s files?

No. The edit changes authentication data and leaves the profile directory in place. The account’s access to encrypted files can still depend on its original credentials, so preserve backups before making the change.

Why is a full shutdown important before mounting the disk?

Windows may leave NTFS metadata marked as in use after hibernation, Fast Startup, or an interrupted shutdown. Editing a volume in that state risks filesystem or registry damage, so complete a normal shutdown before booting the rescue image.