Resetting a Windows Password Using Kali Live Boot and CHNTPW

If presented with a PC that no one can remember the admin pass, and the usage of your Hiron boot disk is not available due to driver support issues, you have an alternative which is to use the Kali live boot.

Once booted into Kali on the local machine, you’ll need to mount the drive. To list all drives use


You’ll be looking for the one of relevant size of the primary partition. You then need to mount this drive using:

mount /dev/SDAX/ /mnt

Where SDAX is the SDA reference for your drive. CD through to the location of the local SAM file

cd /mnt/Windows/System32/config/

Then we can use chntpw to list all local user accounts:

chntpw -l SAM

Once you’ve seen the administrative account you wish to target use

chntpw -u <username> SAM

Menu options become available to blank out the password and unlock the account if needed.

Reboot and login without a password and set it again locally.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s