{"id":851,"date":"2026-10-16T13:00:00","date_gmt":"2026-10-16T13:00:00","guid":{"rendered":"https:\/\/vpslake.com\/blog\/?p=851"},"modified":"2026-10-16T13:00:00","modified_gmt":"2026-10-16T13:00:00","slug":"reset-windows-password-grml","status":"publish","type":"post","link":"https:\/\/vpslake.com\/blog\/2026\/10\/16\/reset-windows-password-grml\/","title":{"rendered":"Reset Windows 10\/11 Password Using GRML"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">To reset Windows password using GRML, boot an authorized Windows 10 or Windows 11 VPS into a GRML live ISO and edit the local account database offline. You can usually regain console access in 10\u201315 minutes without reinstalling the server, then set a new password before reconnecting over RDP.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>A Windows 10 or Windows 11 VPS with a local account whose password you are authorized to recover. This procedure does not recover a Microsoft account, domain account, PIN, or BitLocker-protected volume.<\/li>\n\n\n<li>Access to the <a href=\"https:\/\/vpslake.com\/buy-windows-rdp\">VPSLake Windows RDP service<\/a>, its client area, and the VPS control panel (Virtualizor) with permission to mount an ISO and open VNC.<\/li>\n\n\n<li>The GRML 64-bit ISO downloaded from the <a href=\"https:\/\/grml.org\/docs\/\" target=\"_blank\" rel=\"noopener\">official GRML documentation<\/a> or download page, plus its checksum verified before uploading it.<\/li>\n\n\n<li>At least 1 GB of free disk space for temporary hive backups and enough RAM for the live environment. Your Windows installation must be shut down, not hibernated or left in Fast Startup mode.<\/li>\n\n\n<li>A new, unique password ready to enter at the Windows console after the reset. Do not use a password copied into a shell command or support ticket.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This is an offline recovery operation. Only use it on a server you own or administer; changing another person\u2019s account database without permission is unauthorized access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Attach GRML and open the VPS console<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The live ISO must start before Windows so the Windows system files are not in use.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the VPSLake client area, open <strong>Services \u2192 your Windows VPS \u2192 Open VPS control panel (Virtualizor) \u2192 ISO\/Media \u2192 Attach or Mount ISO<\/strong>. Choose the GRML 64-bit ISO, save the media change, and set the next boot to the virtual CD\/DVD device if Virtualizor presents a boot-order option.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open <strong>Virtualizor \u2192 VNC<\/strong> and select <strong>Restart<\/strong> or <strong>Reboot<\/strong>. At the GRML boot menu, accept the default 64-bit entry and wait for a root shell. If the console opens a graphical desktop instead, open a terminal; the commands below must run as root.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not use the Windows <strong>Restart<\/strong> option before this step if you can still reach the desktop. Use <strong>Start \u2192 Power \u2192 Shut down<\/strong>, because a full shutdown avoids a locked NTFS volume.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Identify the Windows partition<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The device name is different on each VPS, so identify the NTFS volume instead of assuming it is <code>\/dev\/vda2<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lsblk -f\nfdisk -l<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Look for the large <code>ntfs<\/code> partition that belongs to the Windows installation. Do not choose a small EFI, recovery, or reserved partition. A typical result may resemble this, but your device and sizes will differ:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NAME  FSTYPE LABEL  SIZE\nvda                 80G\n\u251c\u2500vda1 vfat          100M\n\u251c\u2500vda2 ntfs         79.5G\n\u2514\u2500vda3 ntfs         600M<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Record the Windows partition as <code>WINDOWS_PARTITION<\/code>, such as <code>vda2<\/code>. If the disk uses a different name, use the complete device shown by <code>lsblk<\/code>, including a partition suffix such as <code>nvme0n1p3<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Mount the Windows system volume read-write<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Mounting the system volume exposes the offline <code>SAM<\/code> database that stores local Windows account credentials.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Create a mount point and mount the partition, replacing <code>WINDOWS_PARTITION<\/code> with the value you identified:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p \/mnt\/windows\nmount -t ntfs-3g -o rw \/dev\/WINDOWS_PARTITION \/mnt\/windows\nls \/mnt\/windows\/Windows\/System32\/config<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Successful output includes the registry hives needed for this recovery:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DEFAULT  SAM  SECURITY  SOFTWARE  SYSTEM<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If <code>ntfs-3g<\/code> is unavailable, check whether GRML has the driver installed before trying another mount method:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>command -v ntfs-3g<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If that command returns a path, retry the mount. If it returns nothing and the GRML session has network access, install the driver and retry:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt-get update\napt-get install -y ntfs-3g<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the volume is reported as hibernated or unclean, stop and boot Windows normally once, then use <strong>Start \u2192 Power \u2192 Shut down<\/strong>. Forcing a write mount can damage the installation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Back up the registry hives<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A local copy gives you a recovery point if you select the wrong account or the edit does not produce the expected sign-in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From the configuration directory, copy the hives to the GRML environment:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/mnt\/windows\/Windows\/System32\/config\nmkdir -p \/root\/windows-hives-backup\ncp -a SAM SYSTEM SECURITY \/root\/windows-hives-backup\/\nls -l \/root\/windows-hives-backup<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The listing should show three files. The backup is stored in the live session\u2019s memory-backed filesystem, so it disappears when GRML reboots; keep the Windows disk and VPS snapshot intact until you have verified access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Clear the forgotten local password<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>chntpw<\/code> changes the offline local account record; it does not reveal the old password. Clearing it temporarily lets you sign in through the VPS console and immediately replace it with a strong one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check whether GRML already includes the utility:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>command -v chntpw<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the command is not found and the GRML session has network access, install it before continuing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt-get update\napt-get install -y chntpw<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">List the local accounts and their relative identifiers (RIDs):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chntpw -l SAM<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The output identifies account names and RIDs, for example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RID: 01f4, Username: Administrator\nRID: 03e8, Username: YOUR_USERNAME<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Start the interactive editor:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chntpw -i SAM<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">At the prompts, choose the option to edit user data, select the intended account by its displayed RID, and choose <strong>Clear (blank) user password<\/strong>. Return to the user menu with <code>q<\/code>, return to the main menu with <code>q<\/code>, and answer <code>y<\/code> when <code>chntpw<\/code> asks whether to write the changes. The <a href=\"https:\/\/www.chntpw.com\/guide\/\" target=\"_blank\" rel=\"noopener\">chntpw guide<\/a> documents the same SAM menu flow.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not select an account only because its profile folder has a familiar name. Match the account name and RID from <code>chntpw -l SAM<\/code>, and leave domain or Microsoft-account entries alone.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Unmount the disk and boot Windows<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Windows must see the saved hive cleanly, and the live ISO must be detached before the normal disk boots.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Leave the configuration directory, flush pending writes, and unmount the mount point:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/\nsync\numount \/mnt\/windows<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In <strong>Virtualizor \u2192 ISO\/Media<\/strong>, choose <strong>Unmount\/Detach ISO<\/strong>, then open <strong>Virtualizor \u2192 Power Control \u2192 Reboot<\/strong>. Keep the VNC console open so you can observe the Windows boot and use the local console if RDP rejects a blank password.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the recovered account<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">At the Windows sign-in screen in VNC, select the recovered local account and leave the password field empty. After Windows opens the desktop, immediately press <code>Ctrl+Alt+Delete<\/code>, choose <strong>Change a password<\/strong>, leave the old-password field blank, and enter a long, unique value twice. If the secure screen is unavailable, open <strong>Start \u2192 Settings \u2192 Accounts \u2192 Sign-in options \u2192 Password \u2192 Change<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The blank password is deliberately temporary. Windows commonly blocks blank local passwords over RDP, so do not treat a failed blank-password RDP attempt as proof that the reset failed. After setting the new password, disconnect the VNC session and start a fresh RDP connection using the local account format <code>SERVER_NAME\\YOUR_USERNAME<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A successful new RDP sign-in is the final check. If you can open an elevated PowerShell window after signing in, confirm the identity without exposing the password:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>whoami<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output resembles:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SERVER_NAME\\YOUR_USERNAME<\/code><\/pre>\n\n\n\n<aside class=\"vl-element vl-cta-banner\" aria-label=\"Need a Windows VPS?\">\n\t<div class=\"vl-cta-banner__content\">\n\t\t<p class=\"vl-cta-banner__eyebrow\">Windows recovery access<\/p>\n\t\t<h3 class=\"vl-cta-banner__title\">Need a Windows VPS?<\/h3>\n\t\t<p class=\"vl-cta-banner__text\">Get a Windows RDP server with console access for remote administration and recovery work.<\/p>\n\t<\/div>\n\t<a class=\"vl-cta-banner__button\" href=\"\/buy-windows-rdp\" aria-label=\"View Windows RDP\">View Windows RDP<\/a>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><code>mount: wrong fs type<\/code> or the volume is read-only<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You may have selected the EFI\/recovery partition, the NTFS driver is missing, or Windows left the volume hibernated. Recheck <code>lsblk -f<\/code>, choose the large NTFS partition, and use <code>mount -t ntfs-3g -o rw<\/code>; if hibernation is reported, boot Windows normally and perform a full shutdown before trying again. Do not run filesystem repair commands merely to bypass a hibernation warning.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>ls \/mnt\/windows\/Windows\/System32\/config<\/code> says the path does not exist<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The wrong partition is mounted, or the Windows directory uses a different drive layout. Unmount it with <code>umount \/mnt\/windows<\/code>, inspect every NTFS partition with <code>lsblk -f<\/code>, and mount the one containing <code>Windows<\/code>, <code>Users<\/code>, and <code>Program Files<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>chntpw: command not found<\/code><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The live image does not include the package in its current session. Connect the GRML environment to the network, run <code>apt-get update<\/code>, and install <code>chntpw<\/code> with <code>apt-get install -y chntpw<\/code>. If the live session cannot reach the network, use a GRML image that includes the package or an approved Windows recovery method instead of downloading an unknown binary.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Windows accepts the console sign-in but RDP still fails<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Blank local passwords are often denied for network logons, and an RDP client may also have cached an old credential. Set the new password at the VNC console first, remove the saved server entry from <strong>Control Panel \u2192 Credential Manager \u2192 Windows Credentials<\/strong> on the connecting computer, and reconnect as <code>SERVER_NAME\\YOUR_USERNAME<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hardening after recovery<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Store the new password in a password manager and remove temporary notes or copies from the console session.<\/li>\n\n\n<li>Detach the GRML ISO so the VPS cannot boot into the recovery environment on its next restart.<\/li>\n\n\n<li>Keep a current VPS snapshot or backup and record the approved console-recovery procedure before the next lockout.<\/li>\n\n\n<li>If the server uses BitLocker, enable and safely store the recovery key; GRML cannot edit a locked encrypted Windows volume.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Can GRML reset a Windows PIN?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. A PIN is a Windows Hello credential, not the local SAM password that <code>chntpw<\/code> edits. Sign in with an available password or use Microsoft\u2019s approved account-recovery and Windows Hello recovery options instead.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does this work for a Microsoft account or domain account?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This procedure is for local Windows accounts stored in the offline SAM hive. Microsoft accounts and domain accounts are managed by their online identity provider or domain controller, so reset them through the appropriate administrator or account-recovery process.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why can I sign in at VNC but not over RDP?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The reset initially creates a blank password, and Windows normally blocks blank passwords for remote network logons. Set a real password at the VNC console, then reconnect with the correct local username prefix and remove cached credentials if necessary.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Will clearing the password delete the user\u2019s files?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. The operation changes the local account credential record, not the profile files. Still, back up the SAM, SYSTEM, and SECURITY hives and keep a VPS backup because any offline registry edit carries recovery risk.<\/p>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Can GRML reset a Windows PIN?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. A PIN is a Windows Hello credential, not the local SAM password that `chntpw` edits. Sign in with an available password or use Microsoft\u2019s approved account-recovery and Windows Hello recovery options instead.\"}}, {\"@type\": \"Question\", \"name\": \"Does this work for a Microsoft account or domain account?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"This procedure is for local Windows accounts stored in the offline SAM hive. Microsoft accounts and domain accounts are managed by their online identity provider or domain controller, so reset them through the appropriate administrator or account-recovery process.\"}}, {\"@type\": \"Question\", \"name\": \"Why can I sign in at VNC but not over RDP?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"The reset initially creates a blank password, and Windows normally blocks blank passwords for remote network logons. Set a real password at the VNC console, then reconnect with the correct local username prefix and remove cached credentials if necessary.\"}}, {\"@type\": \"Question\", \"name\": \"Will clearing the password delete the user\u2019s files?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. The operation changes the local account credential record, not the profile files. Still, back up the SAM, SYSTEM, and SECURITY hives and keep a VPS backup because any offline registry edit carries recovery risk.\"}}]}<\/script>\n\n","protected":false},"excerpt":{"rendered":"Reset Windows password using GRML on Windows 10 or 11 with a VPS console, set a strong local password, and verify RDP access without reinstalling.","protected":false},"author":1,"featured_media":852,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[5,10],"tags":[76,74,32,34,75],"class_list":["post-851","post","type-post","status-publish","format-standard","has-post-thumbnail","category-guides","category-windows-rdp","tag-chntpw","tag-grml","tag-rdp","tag-windows-password","tag-windows-recovery","cs-entry"],"_links":{"self":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/comments?post=851"}],"version-history":[{"count":1,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/851\/revisions"}],"predecessor-version":[{"id":3417,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/851\/revisions\/3417"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media\/852"}],"wp:attachment":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media?parent=851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/categories?post=851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/tags?post=851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}