Try **net user video "password" /add** (replacing "password" with a password) I have no idea why it worked in the video, when that isnt even the correct command That SHOULD be the correct command to create the user

There are few things that might be mentioned. 1. school networks are usually centralized under server that runs Win Server and Active Directory. Meaning that after you reload your machine, all changes will be reverted and you anyway only have access to local machine as admin. You did not escalate your rights outta local PC :) 2. if your admin likes his job, operations like win recover will be logged, as well as history of every CLI in the network. Some better networks use deamons to realtime check on commands that are used, which likely will not be case in school network, but still, carefull what you are doing 3. as far as it might sound silly, if you hack into system that you are not explicitely allowed to, you in fact are breaking law. I doubt anybody would call police on you for this, but there might be consequences. So keep it in mind. Hacking is awesome, cracking things that are not ment to be cracked is great feeling, but choose your steps carefully :)

As the IT Manager of a School, If you can get this to work, without getting caught, i'd be very impressed.

This is a good way to get fired from your job or kicked out of school. Our security tools would instantly hit on the local account being created or given admin rights.

It's quite funny seeing this. I'm 35 now, and when I was 14/15 we used to use command prompt, from a Windows install CD, to replace Sticky Keys with Command Prompt to do the exact same thing for admin rights.

If I had known this 5 years ago... I remember having to do some workarounds to extract games and download separate DLLs to be able to play in class. Funny history: My games folder on the school computer was about 120GBs and had an FTP server to share with my friends. One day the size of the folder caught the attention of the IT guys and they deleted everything. It scared me so much that I stopped downloading stuff there. Oh, good times.

Honestly I was so tempted to try something like this back in the day. My school had a mix of macs and windows machines. The macs were used for productivity (video editing etc) and the win machines were for general use. I never wanted to be in trouble so I minded my business haha. Plus the IT guy was fucking AWESOME and I didn't want to make his life harder lol

It's important to mention this will make a local administrator not a domain administrator so it will only work on this computer.

I remember when I was in high school I found out I could disable the web filter by making a registry change. I had the command to do it memorized, and I'd often do it on school computers even though I had no need to access blocked sites, just because I was a rebel :) I don't remember the command now, but it was a "reg" command, and it disabled the web proxy in the Internet settings. As a side effect, when the proxy server went down, this allowed the Internet to continue working. I never got caught, because I'd always hide the console window off the edge of the screen while I typed it.

I remember when I was in middleschool and windows 7 had a backdoor that allowed you to access the administrative priviledges command line. I did it 3 times and got caught each time :)

When I was in secondary school almost 10 years ago now I used a simple bios hack to set up an admin password on a computer (the school computers used a system called impero to have access to all computers so certain accounts on the system would have access) what they didn’t realise is that admin accounts automatically had complete access to the system that controlled all the computers, so I was able to control any computer on the network. My only mistake was letting my friends in on the secret, they got caught messing around and snitched instantly, the only reason they didn’t exclude me is because I pointed out an “extreme flaw in the security system”. Fast forward 10 years and I have a computer science degree and i’m working in cyber security

imagine not setting up a BIOS password and one of your IT special students does this LMAO! edit: HOLY SHIT! Didn't expect to see that many likes! edit 2: MOM I'M FAMOUS!!!

When using the local account, you don't need the computer name. It's possible to just use an asterisk (*) (correction: that should be a period, not an asterisk) instead. Also, don't forget to change the files back that you renamed in the start of the video. It can't be done from within Windows. You have to go through the maintenance routine again.

I recommend, when changing the name of cmd to utilman, that you instead duplicate it and name it utilman.

I was doing this kind of stuff during high school all the time. At one point me and my friends even managed to get domain administrator accounts with which we could log in to any pc at school. Funny thing is that I actually found out this way that I wanted to study IT and make my job out of it.

We prevent custom boot/changing boot devices with a BIOS password for all of our school devices, so you likely wouldn't be able to reboot into recovery mode. Our firewalls and web proxies will prevent internet access unless the authenticated AD user is known. We also block the downloads of .exe .msi etc. Constantly trying to battle the things that students will try to do lol

Reminds me of my days back in highschool in 2010. Me and my group would remote access into random Macs in the school and make them sing and cuss. We controlled the whole system and took the school a whole year to figure out how to stop it.

No way. I remember using this exact same trick to remove the parental controls on my laptop in like 2008!! Absolutely crazy to see that this exploit still works in 2023 😂

In high school I was on a robotics team, our computers kept getting imaged and we’d lose our software. So eventually I installed windows from scratch on the computer and put a BIOS boot password on it. The IT guy there at the time who I am now friends with told me he shorted out the motherboard and committed warranty fraud so HP sent a new motherboard to get replaced.

Oh, yeah, I forgot about this old glitch. Though, it's so old, it's probably not fair to call it a glitch or bug.... You can stop this by just encrypting the drive.

I did this back when I was in the equivalent of 9th grade. One of the teachers got suspicious after I was able to install some software without needing the admin password. After I told them what I did they were cool and let me stay admin for the rest of the time. Got real lucky.

I tried this at school once, but when I realized that it had a bios password, and to bypass it would involve me opening it up to take out the cmos battery, I gave up. The room was just big enough that i wouldnt be seen so long as I stayed in my seat and did my tinkering from there, but if i got up to go around back to open up the case, i wouldve been seen. Im not sure what the consequences wouldve been for doing this but I wasnt willing to risk being caught doing something potentially illegal for no reason.

What we did was start the computer in safe mode with networking, install firefox, set up proxy and we could access any website or install any app. The only downside to this was that our school ran the server edition of windows so any apps installed in safe mode wouldn't stay when restarted in normal mode and there was no sound in safe mode. We'd play counter strike portable, but these days it's no longer available.

I prefer renaming cmd to the sticky keys executable. I've also seen a way to get into this without a install disk. It has to do with force powering down during boot. Then next time it boots up there are prompts normally not there asking you if you want to try and repair. Then somewhere in those menus you can navigate to system 32

It's even more doable than this if you're comfortable running things in command line. You can get into any windows 10/11 machine without drive protection following a similar method, and without having any premade boot media on you. Super useful when you aren't expecting to need to get into a machine all of a sudden.

Clever. Enable BitLlocker drive encryption so there can be no access to the drive outside of the OS to prevent tampering. And BIOS password that’ll be required to boot anything besides the actual installed OS. Basically, having probably lockdown systems should prevent this from happening.

My school and 261 others have a critical flaw that allow anyone to get domain admin privileges. For those who don't know it means administrator privileges on *every computer* including the AD server. On 262 schools, I could get this access if I made a script and sent it to other people.

oh man i wish this video existed when I was in school, I made a fake login screen which would send credentials to an ldap server. it was super sketchy because i had to tell my teacher that my pc was shutting down every time i entered my password in order to get an admin over to attempt sign-in. it was worth it in the end because the remote control software lead to tonnes of fun shenanigans before i got banned.

there is this rule: You touch it, you own it

I remember watching this a bit ago and thinking "huh, thats pretty cool" and now i forgot the password to a 7 year old laptop so im actually using it. Thanks

Anyone with a chromebook you would need a google enterprise account to sign in with and you can reset your chromebook to factory settings by either unplugging the battery for 30 seconds then trying to turn it back on or turning it off and holding down the reload button and escape key then turning on your computer, let go of those keys, press ctrl + d or ctrl + shift + d, and following directions on screen. You also won’t be able to connect to your schools wifi after this just in case some of you were wondering

It says you need to sign in as an admin to continue 🤦‍♂️

you should revert the renaming process at the end or it would still open cmd and people can find out

little hint for minute 3:20 - You can also type .\ for a local login instead of typing the full computer name. so for the user in the video it would be: ".\video"

Subbed, don't even need to do this, just appreciate small creators making great content

Only issue is that most schools nowadays use something that protects the OS drive from modification. For example, at the colleges I went to, they used a program that would basically reset the partition or Windows installation upon reboot. So you could make changes to the OS, but when the system rebooted, the preboot software would reset and reload a preset boot image and configuration.

I actually did this in school. :) This was especially useful in the computer science classroom to install Steam with games or other programs.

my school is very strict with their pcs :( doesnt even let us play browser games, let alone do things that happened in the video. the IT guy is very smart too and will likely catch on.

Back in the day a Norton utility disk could change attributes. I Miss the old Norton Disk utilities. Using DE (Disk Editor) you could search for and find the Passwd file the remove the Root:: password making it blank then create your own after rebooting. You could do the same with Windows, however I don't remember the exact procedure. (Back then this even worked on encrypted Windows drives) So much has changed.

My school did not do anything to the bios of the school computers , so i installed Arch on it. Whats funny, is that even after I was found out, they still did nothing the bios. Im glad that they did not lock the bios becaus, the device had bitlocker and was Aziur enrolled, so this would not have worked.

my school legit disabled the settings app dawg

Funny story for me, I joined the it club at my high school, and I asked my it manager if I could reset my laptop (Mac air laptop) because of storage reasons. What they give you is a modified install file. What I did is just use a normal one, and I got away with it.

Thank you also ever since i have done this I can activate the school intercom ❤

I usually just reset my school laptop. School doesnt do shit abt it u js gotta be secretive abt it

Ok correct me if im wrong, But shouldn't the schools invest in a bigger computer lab with places to do this without getting in trouble?

Our high school computers have a dual boot with Linux and windows, I managed to reset the Linux admin password and just use that to play games in class.

A administrator would lock down the computer. bitlocker or AD roles would do that, so the c drive is locked. or disabled boot drives in bios, set bios password.

You could also replace sethc.exe with a copy of cmd.exe, this method wont work if your computer has bios lock, is asure enrolled, has bitlocker on, or recovery mode needs admin.

Sounds like a great way to get into a world of trouble if your admin isn't aware of how to counter this. People are literally going to risk their future over being able to play games in class, because teens are immature.

Lol I can see so many comments of how people snuck games into school when they were younger, using some complicated-ass ways nowadays, when you go home, you can just upload a game onto your google drive, then when you get to school, download it onto your schools computer on the provided account (note: at my school, if you try and log into your computer account the next day, everything in downloads is gone, so move it to documents.) (note 2: for extra security, make a new folder named "classwork" and fill it with a bunch of documents from your ACTUAL schoolwork, then hide it in there) *much easier these days*

You could also just wipe the school laptop's hard drive and re install windows, but this method was interesting tbh

Here's what i wanted to share about my school: The computers in my school all have admin accounts. But no one did install a game on any of them. Why? Well, we can only visit the computer classroom only on IT lessons. I think you can visit it on break time, but not turn on the computers. Second of all, why, if you already can play games on your phone, or just play the web games during IT lessons? I do sometimes hope that someone installs a game afterall on one of those bad boys.

for those whose computers aren’t working due to cmd no longer existing! go back into recovery mode and go back to the system32 folder using notepad, then change the names of cmd and utilman first you change “utilman” to “utilman2” then you change “cmd” to “cmd” then you can change “utilman” back to “utilman” then refresh and go back to your login screen and carry on as usual

My school's computers have restrictions on the USB devices you can use. If you plug in a peripheral, it works. If you plug in a removeable device, it doesn't.

A safer option is just bring your own bootable os with everything you want preinstalled.

How about doing a video about exflitrating the SAM, SYSTEM and SECURITY registry keys and cracking them in impacket?

FYI this is a terrible idea on any modern Azure managed device. This will INSTANTLY get flagged as a hijack and be seen by IT. Any security worth its salt will have bitlocker and some bios level security enabled, at the least.

Ok, your method will work most of the time, but also introduces a problem if you intend to leave the backdoor in place. Why not just stick to command line by using something as simple as "cd windows\system32" once you are on the correct drive? "ren utilman.exe utilman.bak", then "copy cmd.exe utilman.exe", that way you still have a functional cmd.exe after the process. Also, a lot of AV will delete utilman.exe if it has an invalid checksum(especially school laptops), so you should also write protect it with "attrib utilman.exe +R". You may still need to spam it a lot as soon as the splash comes up, since some will also prevent execution as well. Of course I in no way endorse this activity without parental ownership and approval of the device in question. I also recommend school owned laptops should have bitlocker on by default.

My college was set so if you needed admin access, it would just say you aren’t allowed and didn’t give an administrative login prompt

Replacing utilman with cmd doesnt work since 2019, at least when the school hasnt fully disabled the Windows Defender. If the school uses a third party solution and fully disables Windows Defender in group policy (which is btw not recommended), this works. But this also requires access to BIOS (or at least Booting via USB set as first priority) and if the school has no BIOS-PW/hasn´t changed Boot Order or removed USB-Boot all together... says much about the school itself or IT-Department of the school.

Alternate Title: How to get suspended.

I can’t find utilman…

I remember just booting Windows from my external hard drive, technically "bringing my whole desktop everywhere".

I remember back in middle school my school decided to update the computers but they forgot or was too stupid to also pre install any admin on the computeband put up blockers on the conputers so we had stadard windows so people were dowlnloading games and whatnot some people downloaded miecraft and others logged onto their xbox accounts 😅😅😅 on a seperate day somone hacked the school systems server which there were like 3 different school districts on that server and they made it so the school could not block any websites so people hopped onto yt and were watching fortnight

Doesn't let me open cmd, it says something like "you need to login as admin butthere are no admin accounts"

jay last question. I need a computer with access to recovery drive but does it matter if the computer has a different windows operating system will it still work the same? (when I put the recovery drive usb into a newer system)

Me: I watched this in school... and now its on my recommended? KZfaq: The algorithm... IT KNOWS

Unfortunately, nowadays, schools use chromebooks and go guardian. So the chance of *not* getting caught is now slim to none

When i click the cmd it tells me to enter the password for the admin

Did this to a school computer ages ago - BIOS password on too (so I couldn't use Boot Menu), but they forgot to make USBs the lowest priority on the boot list. So, if a USB was inserted, it would boot to the USB automatically, without requiring the Boot Menu. 🤣 EDIT: The school's laptops' Wi-Fi profile was so easy to re-import with all required certificates too, but sometimes I had to unplug a nearby printer's Ethernet cable to get some Internet access. 💀

As a data security IT for a casino, the second that thing would get turned off, booted into recovery mode, local admin account created, and AD account permission passed it would've been flagged into my email. Roughly ~1.5 minutes.

Man I already know what the admin account of all the computers in my school is 😂

I worked at a school where you wouldnt be able to get admin access. BIOS Password helps. Even removing the CMOS battery wouldnt help. They had a tool installed that removes every change made to windows and prevents you from installing a new windows unless you use the admin-user password. To prevent people from trying to remove the cover of the pc they added locks to the cover. You wouldnt even be able to get to the CMOS battery even if you tried to (at least not without the teacher noticing what you do) xD

How do I make my standard account admin? Do you have a tutorial for that too ?

So I was the kid that did this, I actually changed sticky keys to cmd and did this on every machine in the IT suite, installing CS go and TF2 on pretty much everything… I was ban from using computers for the rest my time in secondary school - which resulted in me getting a D in computer science 😅 at least the class had a day of playing CS together 😂

1:12 now what you’re going to want to do is set your language to English (World/Global) for the non bloatware version of windows

When I try to change the the name to utilman2 it says says “…file might become unstable are you sure you want to change it” and when I click yes says “This program can’t run This program is blocked by group policy. For more information, contact your system administrator.” What can I do to fix this?

[SOLUTION BELOW] Now my computer is broken because utilman doesn't exist anymore and anyways it didn't work 😢 Is there any way to fix this? Edit: I could fix it by myself. Here are the steps for the people that want to fix it: 1: Go on cmd on Recovery Drive or Windows Install Media 2: Write "notepad", then click "Save As..." 3: Click on "This PC", "Windows (C:)", "System32" and then search for the original cmd file (renamed as "utilman", then rename it to "cmd2". Then, click again "This PC", "Windows (C:)", System32 and then find the original utilman file (renamed as "cmd"), rename it as "utilman". Then, redo the "This PC", "Windows (C:)" and "System32" and then rename the cmd2 for "cmd". 4: Close the file explorer, notepad and cmd and the click "Shutdown". 5: There you go, your cmd and utilman is all fixed like it used to be!

As an Computer Adept. I agree that this is a Very effective Way to get Admin Rights.

Bro said how to realize every student dream

I somehow managed to get access to the backend server of our university, and got the remote access to that server. I did not do anything there, but a few months later I was called by the IT guys and my internet and some other privileges from the university wifi were gone. I had to beg them and promised that this won't happen again. It was scary but fun haha

Will there be any *consequences* for changing password at school? For example like activating school network security or corrupting the pc’s file

Similar method can be done with sethc.exe (just gotta press shift 5 times instead). and can start the process with a Linux live boot USB

At my school it was impossible. We had 2 it rooms so it was possible that all pcs could be at the walls. That made teacher able to see all pcs at once so it was impossible to do crazy stuff... sadly...

The antivirus just stops it from running command prompt saying it is a malicious file. How do I fix this?

i don’t have utilman in my files

this works for almost any win computer not just company managed devices, you could use it to crack into a personal computer as well

I actually did install games on my school laptop but if I had known this the stuff i could have done would’ve been crazy. I was the kingpin of getting games actually. I got caught because I got a little too cocky and didnt check if the game I installed was a virus (I was about 12). IT called my parents, and reset my laptop, deleting all of my mods that actually took some effort to get on there

This can lead to big trouble. Beware of cyber rules at your school or work.

Whenever I click on command prompts it says “you need to sign in as an administrator to continue, but there aren’t any administrator accounts on this PC.” What do I do about that?

We don’t have access to settings app on our school computers. Get recked, my school may have actually done something right for once, despite sucking at everything and screwing everything up, including locking my computer class out of their computers, as well as most of the other computer classes, for a week.

I may be able to do this but since our desks are looking towards the teacher I just share my mobile data with the laptop

I followed all the steps but when i clicked ease of access it didnt bring up command prompt

Command prompt isn’t an option when i try to click on advanced settings. Do you have a fix for that or do you know what the problem may be?

Found that out in 8th grade, installed wallpaper engine instead of the forced school wallpaper and the teacher didnt even notice 😂

this is exactly what I need but im afraid im too stupid. I dont even know how to check for bitlocker, or to even know what windows my school is running on. although i can go into settings and go intp cmd prompt, which some people cant go into

I'm totally doing this on my school pc

Even if I did this the teachers desk is placed behind our desks so they can see what we’re doing..

You don't even need a media. Just keep resetting windows while its booting and eventually it will boot on recovery / repair mode.

For a school computer, is this able to be reversed to turn off admin whenever you may need to, or is it no going back, id assume there is a revert though. Edit: also is this safe for a school computer, not sure whether they’d genuinely give a shit or not. Or does it re-enroll itSelf like chromebooks when reset