Skip to content

Instantly share code, notes, and snippets.

@sunipkm

sunipkm/wac_bypass.md

Created January 30, 2024 16:02
Show Gist options
  • Save sunipkm/012645a82b0270bc206990d2356b45c0 to your computer and use it in GitHub Desktop.
Save sunipkm/012645a82b0270bc206990d2356b45c0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. sunipkm created this gist Jan 30, 2024.
    26 changes: 26 additions & 0 deletions wac_bypass.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,26 @@
    # In case of forgotten Windows Account Password
    1. Boot into a recovery environment/installer
    2. Open a command prompt
    3. Execute `regedit`

    ### In `regedit`
    1. Select `HKEY_LOCAL_MACHINE`
    2. On the menu bar, select `File` -> `Load Hive`
    3. Navigate to `<Windows Install Drive>:\Windows\system32\config\` and load `SYSTEM`
    4. Give it a key name, such as `1234` (this way this key block will live on top)
    5. Expand `HKEY_LOCAL_MACHINE`, and go into `1234`.
    6. Select the `Setup` keygroup.
    7. Set `CmdLine` to `cmd.exe`.
    8. Set `SetupType` to `2`.
    9. Select the `1234` keygroup.
    10. Navigate to the `File` menu and `Unload Hive`.

    Reboot the computer. You will be greeted with a command prompt.

    ### In the `cmd`
    1. List the users: `net user`
    2. Create a new local user: `net user NAME PASSWORD /add` (Make `NAME` without space).
    3. Add the user to admin: `net localgroup Administrators NAME /add`
    4. Exit the shell: Type in `exit` and hit enter.

    Now you can log in with the local account.