{"id":853,"date":"2026-10-16T18:00:00","date_gmt":"2026-10-16T18:00:00","guid":{"rendered":"https:\/\/vpslake.com\/blog\/?p=853"},"modified":"2026-10-16T18:00:00","modified_gmt":"2026-10-16T18:00:00","slug":"reset-windows-password-systemrescuecd","status":"publish","type":"post","link":"https:\/\/vpslake.com\/blog\/2026\/10\/16\/reset-windows-password-systemrescuecd\/","title":{"rendered":"Reset a Windows Password with SystemRescueCD"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">To reset Windows password using SystemRescueCD, boot the server from a live ISO, edit the offline local-account database, and set a new password from the Windows console. The recovery normally takes 10\u201320 minutes and does not require reinstalling Windows.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>A Windows 10, Windows 11, or Windows Server VPS with a local account you own or administer. This method is not for Microsoft accounts, domain accounts, PINs, or accounts on a BitLocker-locked volume.<\/li>\n\n\n<li>Access to the <a href=\"https:\/\/vpslake.com\/buy-windows-rdp\">VPSLake Windows RDP service<\/a>, the VPSLake client area, and Virtualizor with permission to power-cycle the VPS, attach an ISO, and open VNC.<\/li>\n\n\n<li>The current amd64 SystemRescue ISO from the <a href=\"https:\/\/www.system-rescue.org\/Download\/\" target=\"_blank\" rel=\"noopener\">official download page<\/a>, plus its published SHA256 checksum. A 64-bit Windows VPS needs the amd64 image.<\/li>\n\n\n<li>At least 2 GB of RAM for the default live boot and enough storage on the computer used to upload or attach the roughly 1.3 GB ISO. Keep a VPS snapshot or backup available before editing Windows registry hives.<\/li>\n\n\n<li>A strong, unique replacement password ready to enter at the Windows console. Do not put it in a command, screenshot, ticket, or shell history.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Only perform this recovery on a system you are authorized to administer. The offline SAM database controls local authentication, so treat the operation as a privileged account-recovery procedure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Download and verify SystemRescue<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The checksum helps you avoid booting a damaged or altered rescue image.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Download the latest amd64 ISO and its matching <code>.sha256<\/code> file from the official SystemRescue page. On a Windows computer, open PowerShell in the download folder and replace <code>SYSTEMRESCUE_ISO<\/code> with the actual ISO filename:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-FileHash .\\SYSTEMRESCUE_ISO -Algorithm SHA256<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Compare the displayed <code>Hash<\/code> value with the official checksum file. The check is successful when the complete values match:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Algorithm : SHA256\nHash      : MATCHES THE OFFICIAL SYSTEMRESCUE CHECKSUM\nPath      : C:\\Path\\To\\SYSTEMRESCUE_ISO<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Shut down Windows and boot the rescue ISO<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Windows volume must be fully offline before you write to its account hive.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you can reach the VNC login screen, use its power menu to select <strong>Shut down<\/strong>. Otherwise open <strong>VPSLake client area \u2192 Services \u2192 your Windows VPS \u2192 Open VPS control panel \u2192 Power Control \u2192 Shutdown<\/strong>, and wait until the VPS is off. Do not use a forced reset while Windows is still running unless the guest is completely unresponsive.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Attach the image through <strong>Virtualizor \u2192 ISO\/Media \u2192 Mount ISO<\/strong>, choose the verified SystemRescue ISO, and save the change. Set the next boot device to the virtual CD\/DVD when Virtualizor provides that option, then open <strong>Virtualizor \u2192 VNC<\/strong> and select <strong>Power Control \u2192 Start<\/strong> or <strong>Reboot<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the SystemRescue menu, accept the default amd64 entry and press Enter. Wait for the root shell; if a desktop starts, open a terminal. SystemRescue does not automatically mount your Windows partitions, which prevents accidental writes before you choose the correct volume.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Find the Windows system partition<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Linux names disks by device paths rather than Windows drive letters, so use the filesystem type and size to identify the correct volume.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lsblk -f<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Find the large <code>ntfs<\/code> partition that contains the Windows installation. Do not choose the small EFI, Microsoft reserved, or recovery partition.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NAME  FSTYPE FSVER LABEL  SIZE MOUNTPOINTS\nvda                         80G\n\u251c\u2500vda1 vfat                 100M\n\u251c\u2500vda2 ntfs          78.9G\n\u2514\u2500vda3 ntfs                 900M<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In this example, <code>vda2<\/code> is the likely Windows partition. Record the complete partition name as <code>WINDOWS_PARTITION<\/code>; NVMe devices use names such as <code>nvme0n1p3<\/code> rather than <code>nvme0n13<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Mount Windows and make a hive backup<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The SAM file is inside the Windows configuration directory, and a local copy gives you a recovery point if you stop before writing changes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Replace <code>WINDOWS_PARTITION<\/code> with the value from <code>lsblk -f<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p \/mnt\/windows\nntfs-3g -o rw \/dev\/WINDOWS_PARTITION \/mnt\/windows\ntest -f \/mnt\/windows\/Windows\/System32\/config\/SAM &amp;&amp; echo \"Windows SAM found\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected result:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Windows SAM found<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now copy the relevant hives into the live environment, which is normally memory-backed and disappears when you reboot:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/mnt\/windows\/Windows\/System32\/config\nmkdir -p \/root\/windows-hive-backup\ncp -a SAM SYSTEM SECURITY \/root\/windows-hive-backup\/\nls -l \/root\/windows-hive-backup<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should see <code>SAM<\/code>, <code>SYSTEM<\/code>, and <code>SECURITY<\/code> in the listing. Keep the VPS snapshot as well; the temporary backup is not a substitute for a durable backup.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Clear the local account password<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>chntpw<\/code> edits the offline SAM record; it does not reveal the old password. The safest path is to clear the old value, sign in locally, and immediately create a strong replacement in Windows.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm that the current SystemRescue image has the utility and list the accounts:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>command -v chntpw\nchntpw -l SAM<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output resembles:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/chntpw\nRID: 01f4, Username: Administrator\nRID: 03e8, Username: YOUR_USERNAME<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Start the interactive editor:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chntpw -i SAM<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">At the prompts, choose <strong>Edit user data and passwords<\/strong>, select the intended account by the RID and username shown by <code>chntpw -l<\/code>, then choose <strong>Clear (blank) user password<\/strong>. Do not select <strong>Promote user<\/strong> or alter an account you cannot identify. Press <code>q<\/code> to leave the user menu, press <code>q<\/code> again to leave the main menu, and answer <code>y<\/code> when the program asks whether to write the changed hive.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The successful write confirmation is similar to this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Hives that have changed:\n # Name\n 0\nWrite hive files? (y\/n) [n] : y<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Unmount the disk and return to Windows<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Unmounting flushes the hive change and releases the NTFS volume before Windows opens it again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/\nsync\numount \/mnt\/windows<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>umount<\/code> should return to the prompt without an error. Then use <strong>Virtualizor \u2192 ISO\/Media \u2192 Detach\/Unmount ISO<\/strong>, followed by <strong>Virtualizor \u2192 Power Control \u2192 Reboot<\/strong>. Keep VNC open so you can complete the first sign-in without depending on RDP.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the recovered account<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">At the Windows sign-in screen in VNC, select the recovered local account and submit an empty password. As soon as Windows opens, press <code>Ctrl+Alt+Delete<\/code>, choose <strong>Change a password<\/strong>, leave the old-password field empty, and enter the new strong password twice.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the secure screen is unavailable, use <strong>Start \u2192 Settings \u2192 Accounts \u2192 Sign-in options \u2192 Password \u2192 Change<\/strong>. Then disconnect VNC and start a new RDP connection using the local identity format <code>SERVER_NAME\\YOUR_USERNAME<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After signing in, open PowerShell and confirm the account identity:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>whoami<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SERVER_NAME\\YOUR_USERNAME<\/code><\/pre>\n\n\n\n<aside class=\"vl-element vl-cta-banner\" aria-label=\"Need a Windows VPS?\">\n\t<div class=\"vl-cta-banner__content\">\n\t\t<p class=\"vl-cta-banner__eyebrow\">Windows recovery access<\/p>\n\t\t<h3 class=\"vl-cta-banner__title\">Need a Windows VPS?<\/h3>\n\t\t<p class=\"vl-cta-banner__text\">Get a Windows RDP server with console access for authorized recovery and administration.<\/p>\n\t<\/div>\n\t<a class=\"vl-cta-banner__button\" href=\"\/buy-windows-rdp\" aria-label=\"View Windows RDP\">View Windows RDP<\/a>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><code>NTFS volume is hibernated<\/code> or the mount is read-only<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Windows Fast Startup, hibernation, or an unclean shutdown left the filesystem in a state that is unsafe to modify. Boot Windows normally if possible, disable Fast Startup temporarily, choose <strong>Start \u2192 Power \u2192 Shut down<\/strong>, and retry; do not force a write mount or run repair tools just to bypass the warning.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>Windows SAM found<\/code> does not appear<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The selected partition is probably the EFI, recovery, or data volume. Run <code>lsblk -f<\/code> again, unmount with <code>umount \/mnt\/windows<\/code>, and test the large NTFS partitions until the one containing <code>Windows<\/code>, <code>Users<\/code>, and <code>Program Files<\/code> is mounted.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>chntpw: command not found<\/code><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You may have booted an old or incomplete rescue image. Re-download the current amd64 ISO from the official SystemRescue download page, verify its checksum, and attach that image again; the current package set includes <code>chntpw<\/code> and the NTFS tools.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">VNC accepts the blank password but RDP rejects it<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Windows commonly blocks blank passwords for remote network logons. Set the real password at the VNC console first, then remove the saved entry under <strong>Control Panel \u2192 Credential Manager \u2192 Windows Credentials<\/strong> on the RDP client and reconnect with <code>SERVER_NAME\\YOUR_USERNAME<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hardening after recovery<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Detach the rescue ISO so the VPS boots Windows on its next restart.<\/li>\n\n\n<li>Store the replacement password in a password manager and remove temporary copies from your workstation and console notes.<\/li>\n\n\n<li>Keep a current VPS snapshot and document the approved recovery process for the next administrator.<\/li>\n\n\n<li>If BitLocker is enabled, store its recovery key separately; an offline SAM editor cannot unlock an encrypted Windows volume without the key.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Can SystemRescue reset a Microsoft account password?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. SystemRescue changes the local SAM database, while a Microsoft account is managed by Microsoft\u2019s online identity system. Use the account provider\u2019s recovery process or sign in with an available local administrator.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does this method work for an Active Directory account?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. A domain account is validated by the domain controller, not solely by the local SAM hive. Ask a domain administrator to reset it through the approved domain-management tools.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Will clearing the password remove the user\u2019s files?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. The edit changes authentication data and leaves the profile directory in place. The account\u2019s access to encrypted files can still depend on its original credentials, so preserve backups before making the change.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why is a full shutdown important before mounting the disk?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Windows may leave NTFS metadata marked as in use after hibernation, Fast Startup, or an interrupted shutdown. Editing a volume in that state risks filesystem or registry damage, so complete a normal shutdown before booting the rescue image.<\/p>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Can SystemRescue reset a Microsoft account password?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. SystemRescue changes the local SAM database, while a Microsoft account is managed by Microsoft\u2019s online identity system. Use the account provider\u2019s recovery process or sign in with an available local administrator.\"}}, {\"@type\": \"Question\", \"name\": \"Does this method work for an Active Directory account?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. A domain account is validated by the domain controller, not solely by the local SAM hive. Ask a domain administrator to reset it through the approved domain-management tools.\"}}, {\"@type\": \"Question\", \"name\": \"Will clearing the password remove the user\u2019s files?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. The edit changes authentication data and leaves the profile directory in place. The account\u2019s access to encrypted files can still depend on its original credentials, so preserve backups before making the change.\"}}, {\"@type\": \"Question\", \"name\": \"Why is a full shutdown important before mounting the disk?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Windows may leave NTFS metadata marked as in use after hibernation, Fast Startup, or an interrupted shutdown. Editing a volume in that state risks filesystem or registry damage, so complete a normal shutdown before booting the rescue image.\"}}]}<\/script>\n\n","protected":false},"excerpt":{"rendered":"Reset Windows password using SystemRescueCD from a live ISO, clear a local account password safely, and restore RDP access without reinstalling.","protected":false},"author":1,"featured_media":854,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[5,10],"tags":[76,32,77,34,75],"class_list":["post-853","post","type-post","status-publish","format-standard","has-post-thumbnail","category-guides","category-windows-rdp","tag-chntpw","tag-rdp","tag-systemrescue","tag-windows-password","tag-windows-recovery","cs-entry"],"_links":{"self":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/853","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/comments?post=853"}],"version-history":[{"count":1,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/853\/revisions"}],"predecessor-version":[{"id":3418,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/853\/revisions\/3418"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media\/854"}],"wp:attachment":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media?parent=853"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/categories?post=853"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/tags?post=853"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}