Introduction 0:00 Explaination 0:57 Targets 1:48 Installing Win 3:08 Main Stuff 5:29 BOOM 9:05 (Thank me later, 😉)

This was actually useful and not a rigged scenario, good work on this one.

Hey! I just wanted to thank you for showing us this exploit. No harm intended, it's just super convenient to repair users pcs this way in case they forget passwords

You are right on point with this one...I have been locked out of my admin account for 3 months....not anymore.Ty for this video

Your English is so good I saw a video that you had posted about 7 years ago They just randomly come across and I've noticed the difference between how you speak now and then I just want to save me amazing progress! I honestly thought he lived neither Canada by the way you need to come to Vancouver since you were doing it doing survey or God forbid you lived in America. Lies speaking at a Native speakers level for English impressive

Not only this, there is one more option to reset password known as SETHC. Simply you just need to replace your SETHC key with cmd just like this as Utilman.exe to cmd.exe, Then you only need to press SHIFT button 5 consecutive times and then boom You'll see a command prompt where you'll be able to reset the password by using the same commands.. Happy Learning- :) :)

You don't need an installation media at all but just upon botting windows force power off it then power it on and press F10 or F8 for repairing it then it boots from the recovery partition and you get CMD and you can do the same steps (sticky keys glich) to reset windows password. * A smart guy can disable sticky key glitch but you still can do it through booting again from an installation media or as I said from repairing boot partition the load the hive of offline windows then reactivate the sticky keys again.

Very good because you left everything intact and only accessed what you needed. Normally others like spotmau would remove the pswd completely which raises eyebrows

I bought your course on udemy but i learn a lot from your KZfaq channel 😅😂

Always thanks for your help mr. Loi❤

Just go to startup recovery menu, open cmd, then open notepad, see all files, rename sethc.exe to something.exe and cmd.exe to sethc.exe then restart computer and logon screen press shift button 5 times and then you will have command prompt with admin access..

Thanks you so very much. I have been fighting to try and remember the password on my PC, but you made it easy to figure it out. Thanks again.

Now that is exactly the reason why most administrators block the use of external media on their network. So this only will work on privatly owned computers or computers is small organizations.

actually it's called "supply chain" attack vector and widely used not only for fun hack windows. for example, if you replace DLL (win) or SO (lin) libraries with your own doing the same things as original but plus your stuff there (bind or reverse shell, etc.), then any SW which uses (depends on) that libraries will be under your control with the rights of person who run the SW. enjoy! ;-)

Nice UI bro ! The most awesome thumbnail ever seen .

So many comments saying 'this is old news/technique'. So what. Ive never seen it, or thought of it. Thanks MASS for sharing this. Im not intending to use it maliciously, but as someone somewhat new to the cybersecurity field, it's certainly something im glad I'm now aware of and to consider. 👍💯

OLD BUT INTERESTINGG SPECIALLY I LOVE YOUR EXPLAININGG WAY MR. LOI 👍👍👍👌👌👌

You are simply Great. Microsoft must hire you.

Good for private PCs and any other PC not secured. If this hack works for your corporate PC, report it and get your IT security officer replaced or on some training class. Generally, with an unsecured PC, anyone with physical access to the box has full data access.

this method old about 100 years 😂

I remember doing this on my moms laptop on win 7 as a kid. Remember kids when you are taking your SOLs at the end of the year sign yourself out and tell the teacher you are signed out and there is a chance you can shoulder surf the password she/he enters. From there you can use that account to sell local administrative accounts created on a pc of a student choosing, for around 5-10$ Also while you are at it put some fun games on the student share drive.

Cool tutorial but if the PC is more secure, it will likely have password required to access bios or boot.

CONGRATS Mr.Loi Liang Yang on 1M subs🎉, such great content deserves a lot more.

Rusty Gold 👍 Next Level is: Show how to reset / crack a Domain Admin Account (i know already a few tricks but..) then you have maybe my subscription. Good work 👍

Very great video ! U can also in command prompt use Notpad and navigate in the directory with windows interface :D

Why you renaming twice? Just rename cmd.exe to cmd.exe.bck and rename sethc.exe to cmd.exe, then reboot and hit shift button several times until cmd.exe pops out 😊

your the man! well done broseph

Cant believe this stills works, it goes back to previous versions of windows, just a slightly different way into the cmd prompt

sir, very thanks for teaching us soo many intresting ethical hacking topics to us . now we are able controll , acsess, pcs with soo much knowledge becauseof you sir so thank you sir, uday kumar

Works IF you can boot from the created media - if the BIOS has a password and boot from USB (or CD) is turned off, you can't boot the media. However, a really handy way to get into a system if the user has forgotten the admin password and they have not also set (and forgot) the BIOS password.

That writing on the screen is a nice touch some new form of ethical video hacking I like it one time I popped in and out of my friends PC when he's watching one of my KZfaq videos when is Xbox and cell phone Etc

The only other gate to get through is the pc could be using bit locker so you’d need the recovery key. I Used this method twice this week already. 😀

I was literally doing this backdoor back in 2010 when my dad wouldnt let me jump on the computer lol

Doesn't work for any organization with proper IT. Regularily to boot from a media or to open the command prompt you'll have to enter the admin passworr aswell. Or they just shut off the USB ports entirely

Mr Yang, hope that i find you and the family all in good spirits 🙏🏾 this video was an absolute dream, really got me out of a sticky situation. Keep up the good work sir, stay blessed 🙏🏾😃

😂You saved me the second time thank you😅❤

I loved how he used steam as an example, for true gamers who just want to play game on their work computer 😇

Can you do the same video with a usb? I’m pretty confused and unsure what to do. Please and thank you

Loi again with a masterpiece

subscribed and liked i just done this with my own pc and now i have admin

🥶😱😱😱hoh thank you thank you so much 🤣I have this problem today 😅🎉❤

I waited years 😯 but someone has actually made video on this topic ❤🎉thanks a lot brother😊

instead of needing that usb go to restart while holding shift restart (in login place restart there) and find cmd in advanced place there

U REACHED 1m SUBSCRIBER !!! 🎉🥳

Happy to see this trick still works

CONGRATS LOI YOU GOT 1 MILLION BROOOOOO 🎉🎉🎉🎉🎉

CONGRATS FOR GETTING 1M SUBS!!

also without creating any user insert explorer it will create full admin profile once you quit it will be deleted that's how you remain undetectable also work on any windows just rename osk.exe to cmd hit 5 times shift bouton

Any system admin has this method locked down so hard… Fun to find out the security of public machines..

HUGE THANKS. LIKE A HUGE ONE. It really works and helped a lot.

I got myself a cheap little dell optiplex 3000 and its im guessing an old work computer with some decent specs but im unable to reset the computer and remove all data should this work on a domain admin work pc???

Useful for recovery of lost admin password

It is no need to have a bootable USB, you can force the PC to go for startup diangose due to few failed startups (PC turned off while booting) and then just go to troubleshooting and select CMD.

Lots of Love From Nepal

Skipping this months vulnerability I would say this is one of the reasons Microsoft wants everyone to enable Bitlocker.

Couldn't you just shift +f10 when in windows setup for cmd page? so you don't go to next, repair etc. also when in sys32 you could do this as well : ren utilman.exe utilman.exe.bak copy cmd.exe utilman.exe done

*Guidance needed.* I have a computer which has a bios password so loading Linux live is a no go (stuck on secure boot). When I turn it on, it shows the logon, then a loading wheel as if it logged in, then for a fraction of a second it pops up a power shell, then loads a “T” app (shows a “T” in a purple square and 2 silhouettes, for the App logo), then says “can’t logon with no internet connection” and prompts me for credentials. Any idea on how to bypass this? I’ve been trying to stop the startup programs via a windows setup cmd but it’s been to no avail. No, this isn’t stolen and yes, it is my property! I purchased an HP Slice G2 from an estate sale, it had a sticky note on it with the “credentials” but they are not valid. And when I contacted the people, they said “all sales are final and unfortunately the credentials written on the item are the only credentials that will be given”. Usually I just pop in a live kali and have my way with it but the secure boot is impeding this option.

If your boot is locked in bios just unplug the battery from bios in your laptop or pc and it will remove the lock on bios

You helped me a lot thanks bro

Hey Loi, I cannot access my admin user account and now every time I click on sign in button it keeps looping back to the login screen yet I can access my 'Other' user account which I created for guests but now I am the guest and don't have admin privileges. And I have tried net user administrator /active:yes it doesnt work and on Computer manager tool Local users group tab is not available. Please help

Thanks man, it really worked....

wow this is really handy thanks!

Would this (using a Win USB boot stick as you described) work if my office machine is locked down with bitlocker? Wouldn't I need to be logged in with that before I could could mess with the registry/disk contents? Which would be 'hard' to do on a USB reboot, no?

if step 3 disabled and cant change it, none this will work. step 3 is crucial and a must for this to work. most school computers n laptop loans have step 3 ability disabled..

Physical access to a computer is to own it - Linux, Mac, or Windows. You are using another operating system (you boot from) to overwrite/modify parts of the base OS for access, try this on an encrypted drive using hardware tpm/secure enclave without the restore key/pw.... then I'll be impressed ;)

That's a lot of work. Why not just boot into a Linux rescue image and use "chntpw" ?

I’m trying to do this with a USB there is no Windows folder to access . I get a command saying “ Windows” is not recognized. When i try to use iso file on an ssd the computer automatically boots and I can not access the command prompt.

One Can Also Do The Same With Live ISO Of Linux. Plus Point :- You Get GUI For Renaming Files.

You can even fo it without he usb drive but the thing is when it doesnt let you execute cmd because of another program blocking it

thank you for your teaching🙏

The best mitigation from someone that has physical access is full disk encryption

I do not have admin rights and bit locker is stopping me from changing those rights I cant get the system to allow me to change the drive to C on my surface pro 7 when i boot from the usb windows media disk. HELP

To save a lot of time, just hold shift and click reboot, and you get into same recover mode as with the windows cd. Also the method does not work on bitlocker encrypted harddrive.

Hi, thanks alot for the interesting video and for all the steps. Now I followed the steps and was able to create a new user. I unfortunately cannot use it as an Admin as it says, the domain is not available and i've to make sure that the device connected to the organisation's network . Any idea how to solve this? Thanks.

"Now who are you?" - That got me 🤣🤣🤣

I flashed my mobo BIOS and it locked me out of Windows. Bummer! If you can get to the Repair menu just by repeatedly hitting the PC's reset button, you can use the command prompt to use this procedure to delete [or change, I guess] the Admin password and get back into Windows or do whatever. The process was a lifesaver for me.

999K Subscribers, 1M soon 🎉

Ant this method only works with local accounts. Since windows 10 and 11 MS has been pushing for using online accounts.

Doesn’t work with secure boot bios’ or locked bios with bootable media disabled.

Do you have a method of forcing a reset on display settings? I upgraded from a 2060 to a 7900 XT. And I'm locked to 75Hz, in game. Regardless of what settings I use.

Damn that was actually pretty slick.

Loi Liang Yang happy newyear!

Bootable flash with a toolset waay easier and less invasive.

Please!! I need help for the part with command prompt, how do we do it with USB?😢

it wont even let me open that downloaded thing its asking for admin pass..

The first step of the "create installation media for Windows" still needs me to add the administrator password, I've been locked out of the administrator account for 3 years now, Is there any way I can bypass this?

I use this trick for fixing some user accounts for PC's in our organization for password continuity. Otherwise I'd have to reimage the computers with the specific software and reconfigure a whole lot of stuff again.

when i click on the download in installation media it makes me use admin.... i dont have admin

I had already thought about that! So that's why I activated the password to enter the BIOS and BOMM

i get asked for administration when i try to open the windows download ://

Can you do this on a remote computer or do it have to be accessed physically?

Why when i type in cd windows it says system path cannot find the specified path

Congratulation 1m subscribers

Tried this but not working 😢, I cant access the downloaded (media Creation tool) when I double click it, I need to enter the admin user name and password 😢😢

You left out some points. In cmd the external drive is not always D:. I had to run a list and find the correct disk. I think you forgot that not everyone is using the same external drive as you.

Can someone help me, Ever since i used this method every time i start my computer and log onto my account, command prompt opens multiple times on startup and i have no way of disabling it, its very annoying

SUI I'm just a kid and now I don't need to wait for my parents to come home from church and type in the password so i can install java 21

Sir, whenever i use cmd or system image recovery it always want me to choose a user and ofcourse it's admin but after i click on it.... It requires pwd😢 what to do???!

teacher please make a tutorial KRACK Attack- Bypassing WPA2 thank you very much for your attention

For me after selecting source cd windows not working