How to Reset a Windows Server 2012 R2 Password

When you need to reset Windows password access on a Windows Server 2012 R2 VPS, use its VNC console and Windows Recovery Environment instead of reinstalling the server. The recovery, password change, cleanup, and verification normally take about 15 minutes.

Prerequisites

• A Windows Server 2012 R2 VPS with the local account you are authorized to recover. The procedure is for local accounts, not domain accounts.
• Access to the VPSLake Windows RDP service, the VPSLake client area, the VPS control panel (Virtualizor), and its VNC console.
• Permission to power-cycle the VPS and attach or detach virtual CD/DVD media.
• A Windows Server 2012 R2 installation ISO. If the server disk uses VirtIO and is invisible in recovery, you also need a matching VirtIO driver ISO.
• A strong, unique replacement password ready to enter at the console. Do not paste it into a ticket, chat, article, or command that records shell history.
• The server should not be protected by BitLocker unless you have its recovery key; WinRE cannot edit a locked volume without it.

Step 1: Boot into Windows Recovery Environment

WinRE provides a command prompt before Windows signs in, so you can work on the installed system while the locked account is offline.

In the VPSLake client area, open the service and launch its VPS control panel. In Virtualizor → ISO/Media or the equivalent virtual CD/DVD control, mount the Windows Server 2012 R2 ISO, then open Virtualizor → VNC and reboot the VPS.

At the boot prompt, choose the virtual CD/DVD drive. On Windows Setup, select the language and keyboard layout, then open Repair your computer → Troubleshoot → Advanced options → Command Prompt. If the prompt starts at X:, that is the temporary recovery volume, not necessarily the Windows installation.

Microsoft describes this recovery environment in its Windows Recovery Environment reference.

Step 2: Make the Windows volume visible and find its drive letter

The recovery environment may lack the VirtIO storage driver, and its drive letters can differ from those used during a normal boot.

First check whether the installed disk is already present:

diskpart
list volume
exit

If the Windows volume is missing, eject the Windows ISO in Virtualizor and mount the VirtIO driver ISO. Identify the driver disc and locate the storage driver:

dir D:\
dir D:\viostor /s /b | findstr /i "viostor.inf"

For a typical Windows Server 2012 R2 VirtIO image, load the 64-bit driver with:

drvload D:\viostor\2K12R2\amd64\viostor.inf

WinRE should report that the driver was added. If the dir command showed the file under a different folder, use that exact viostor.inf path instead. Eject the driver ISO and mount the Windows ISO again before continuing.

Run DiskPart again and identify the large NTFS volume. Confirm its contents rather than assuming it is C::

diskpart
list volume
exit
dir C:\Windows\System32\cmd.exe
dir D:\Windows\System32\cmd.exe
dir E:\Windows\System32\cmd.exe

The correct drive returns a file listing for cmd.exe. Use that letter as WINDOWS_DRIVE below; for example, if the file is on E:, replace WINDOWS_DRIVE: with E:.

Step 3: Temporarily open a command prompt at the sign-in screen

Making a backup first lets you restore the original accessibility program immediately after changing the password.

Change to the installed Windows system directory. The commands below temporarily replace Utilman.exe, which is launched by the Ease of access button, with cmd.exe.

WINDOWS_DRIVE:
cd \Windows\System32
if exist utilman.exe.bak echo STOP_BACKUP_EXISTS
ren utilman.exe utilman.exe.bak
copy cmd.exe utilman.exe
dir utilman.exe utilman.exe.bak

If the first command prints STOP_BACKUP_EXISTS, stop and restore that existing backup before doing anything else. A successful copy reports 1 file(s) copied, and the directory listing should show both utilman.exe and utilman.exe.bak.

Close Command Prompt, choose Continue to boot from the internal disk, and detach the Windows ISO or change the boot order so the VPS starts from its virtual disk. At the Windows sign-in screen, select the Ease of access button. A command prompt should open with the permissions needed for the local account reset.

Step 4: Set a new local password

Using an asterisk makes Windows request the password interactively, so the new credential is not displayed in the command line.

List local accounts and copy the exact account name, including any spaces or capitalization shown:

net user

Reset the intended local account, replacing the placeholder with that name:

net user YOUR_LOCAL_USERNAME *

Type the new password twice when prompted. Windows should display:

Type a password for the user:
Retype the password to confirm:
The command completed successfully.

If the account is disabled, enable it from the same authorized recovery prompt and then repeat the reset:

net user YOUR_LOCAL_USERNAME /active:yes
net user YOUR_LOCAL_USERNAME *

This changes a local account on the installed server. It does not reset a domain identity or a Microsoft account. See Microsoft’s net user command reference for the supported syntax.

Step 5: Restore the original accessibility program

Leaving cmd.exe in place would give anyone who reaches the sign-in screen an elevated command prompt, so complete this cleanup before using the server normally.

Boot from the Windows ISO again and open Repair your computer → Troubleshoot → Advanced options → Command Prompt. Load the VirtIO driver again if the Windows volume is not visible, identify the correct drive as in Step 2, and restore the saved file:

WINDOWS_DRIVE:
cd \Windows\System32
del utilman.exe
ren utilman.exe.bak utilman.exe
dir utilman.exe
if exist utilman.exe.bak echo BACKUP_REMAINS

The listing should show the restored utilman.exe, and BACKUP_REMAINS should not appear. Detach the ISO, boot from the VPS disk, and keep the VNC console available until the new RDP login succeeds.

Verify the new Windows password

First sign in at the normal Windows console with the new credential. Open an elevated Command Prompt and inspect the local account:

net user YOUR_LOCAL_USERNAME

The important fields should resemble this, with a recent date on your server:

Account active               Yes
Password last set            <recent date and time>

Now disconnect the current session and start a fresh RDP connection. For a local account, use SERVER_NAME\YOUR_LOCAL_USERNAME or .\YOUR_LOCAL_USERNAME, then enter the new password. Finally, select the sign-in screen’s Ease of access button; it should open the normal accessibility options rather than Command Prompt.

Troubleshooting

list volume does not show the Windows disk

WinRE is usually missing the VirtIO storage driver, or the driver ISO is not attached. Mount the matching driver ISO in Virtualizor, locate viostor.inf under D:\viostor, run drvload against the 64-bit file, and repeat diskpart → list volume. Never initialize or format a disk from this recovery session.

ren utilman.exe utilman.exe.bak says the file was not found

The selected drive is probably X: or another recovery volume. Test each candidate with dir DRIVE:\Windows\System32\utilman.exe and use the volume that contains the installed Windows directory. If no volume contains that file, stop and resolve the storage or BitLocker issue before changing anything.

Ease of access still opens the normal tools

The replacement may have been made on the wrong drive, or the VPS may have booted from the ISO again. Recheck the cmd.exe listing, confirm that the copy reported one file copied, detach the ISO, and boot from the virtual disk. Restore the original file after the password change even if the first attempt did not work.

The new password is rejected over RDP

The account name may have the wrong local/domain prefix, the RDP client may be sending a saved password, or the local account may still be disabled. Confirm the account with net user, connect as SERVER_NAME\USERNAME or .\USERNAME, and remove the server entry from Control Panel → Credential Manager → Windows Credentials on the client before trying again.

Hardening after recovery

• Detach all recovery and driver ISOs, then remove temporary snapshots or copies that contain the replacement password.
• Store the new credential in a password manager and use a separate named administrator for routine work.
• Restrict RDP to trusted addresses or a VPN where possible, and keep the Windows firewall enabled.

FAQ

Does this method work on Windows Server 2016, 2019, or 2022?

The WinRE and net user portions also apply to later Windows Server releases, but the installation media and VirtIO driver folder must match the installed release. Use the corresponding recovery ISO and confirm the target volume before editing system files.

Can I reset a domain administrator password this way?

No. This procedure changes a local account database on one server. A domain password must be changed through the domain controller or the organization’s approved identity-management process.

Can I do this without VNC?

Not reliably. The VPS must be booted from virtual media and the recovery prompt is outside a normal RDP session, so you need an out-of-band console such as VNC or an equivalent provider console.

What if BitLocker asks for a recovery key?

Stop at that screen and retrieve the authorized BitLocker recovery key. Do not attempt to bypass encryption or overwrite the volume; without the key, offline system-file changes cannot proceed safely.