Recover Administrator access on Windows 10

There may be some situations where you lost an administrator password on Windows and don’t have any other administrative access to the computer. In these cases you can technically recover access by creating and using Windows recovery media, this article will cover the steps to complete this.

Please note that this method would be considered non-standard and the actions taken to could lead to damaging your Windows installation and prevent you from using the computer regularly without reinstalling the operating system. We do not officially support or condone using this method, you assume any risk by following these instructions and we only provide these as a last resort while offering no guarantees.

You will either need the original installation media that you used to install Windows 10, or if you don’t have that you can create a bootable USB / CD by visiting this link and using the Windows 10 installation media tool.

Instructions

• Insert the bootable Windows 10 USB/CD media into the computer, then reboot
• While rebooting you will likely need to change the default booting device on the computer. The method to do this is specific to your computer, generally this menu can be accessed by pressing a designated function key (F1-F12 for example) – look for a prompt while the computer boots or refer to your computer manufacturers documentation if you’re not sure

• Once you’ve booted to the installation media, click Next, then click the Repair your computer option
• Click Troubleshoot, then click Command Prompt

• At the command prompt enter the following commands (one per line):

   diskpart
   list volume

• After entering the list volume command, check the output, look for the volume with a letter that is of the type Partition, remember this letter as we’ll need it shortly
• Continue entering these commands (one per line, and replace the {LETTER} placeholder in the command with the actual letter you found above):

   exit
   cd /D {LETTER}:\Windows\System32
   ren osk.exe osk.exe_original
   copy cmd.exe osk.exe
   shutdown /r /t 0

• After the final command your computer will reboot, once it finishes booting, click the accessibility icon, then click On-Screen Keyboard. This should now open a command prompt window
• If you’re resetting a password for an existing account, you can enter the command net user to display a list of accounts, when you know the account name enter the the following command (substituting {user} with the actual username and {password} with the new password you’ll be setting):

  net user {user} {password}

• If you don’t have an admin account to reset the password, you can enable the default Administrator account on the computer with the following command (reboot after to display that account and allow you to log in):

  net user Administrator /active:yes

• Once you’ve regained access you should undo the changes you made so as to restore the security of your computer, you can do so easily by opening an administrative PowerShell session (press Windows Key+X to show the power user menu and click Windows PowerShell (Admin)) and copy+paste the following command into the prompt:

  Remove-Item "$($env:windir)\System32\osk.exe" -Force -Confirm:$false; Set-Acl -AclObject (Get-Acl -Path "$($env:USERPROFILE)\Desktop") -Path "$($env:windir)\System32\osk.exe_original";Rename-Item -Path "$($env:windir)\System32\osk.exe_original" -NewName "osk.exe"; Set-Acl -AclObject (Get-Acl -Path "$($env:windir)\System32\cmd.exe") -Path "$($env:windir)\System32\osk.exe"; net.exe user Administrator /active:no

Following these instructions should allow you back into your computer in most cases. It’s important to undo the changes you made to the exe files when you’re done, otherwise anyone else could technically use the same commands to bypass your password to access the computer. Thanks for reading!