Windows 2003 server password recovery on VMware ESX

Having too much systems to work on has one small disadvantage – there’s a hell of a lot of Administrator and root passwords to remember. And yesterday happend what was meant to happen for some time  – I forgot an Administator password for one of my Windows 2003 Servers. For obvious security reasons (I had no pencil on my desk) I haven’t noted password to this machine anywhere.

The server is running on my company VMware ESX server and I decided to hack into it. VMware Infrastructure Client has great ability – it let’s you share your local CD (or .iso image) to the server. I don’t need to say more, do I? ;) Yes, it is so simple.

So, here’s a step by step tutorial how to reset Administrator’s password on Windows 2003 server running on ESX. Prerequisites:

– VMware Infrastucture Client

– Permission from system’s administrator (don’t be naughty!)

– Live CD with your prefered password tools (I took http://pogostick.net/~pnh/ntpasswd/ 3MB only!)

Disclaimer: The procedure below can destroy data on your server, use on your own risk! I don’t take any responsibility of the damages you may cause trying to runt the procedure (or any of its parts).

1. Stop the server. I had to shut down VM image, not good for file system, but I had no choice.

2. Edit preferences of your image to enable remote CD drive:

3. Change boot options to set boot delay

My image has been set to boot from Hard Drive first. I had to go into bios settings to set boot order. I’ve also set 10s delay on booting to give myself time to connect CD image – on power on it’s unconnected.

4. Power on machine and set up boot order

5. Connect iso image. Quickly, before system start booting :)

6. See system booting from CD, use your the tool to reset Administrator password.

7. Enjoy!

Hint:

It was impossible on my machine to set new Administrator password using ntpasswd. I had to use option to blank the password.