Blog

Forgot your Windows password and don't have a recovery disk? You might think your data is gone, but there's a legitimate way back in using Kali Linux—assuming you own the machine or have written permission. The trick is chntpw, a command-line tool that directly edits the Windows SAM registry hive to clear or change a local account password. No brute-force needed; it modifies the credential database while the Windows partition is offline.

Before you try this, understand the legal side. The steps below are for recovering access to a system you own or have explicit authorization to test. Using this on someone else's machine without consent is illegal in most places. Treat it as a learning exercise in digital forensics, not a hacking shortcut.

What You Will Need

• A computer with a locked Windows account (Windows 7, 8, 10, or 11).
• A USB drive (at least 4 GB) with Kali Linux installed as a live system. If you need help creating one, see our guide on How to Install Kali Linux on VirtualBox—the same ISO can be written to USB with tools like Rufus or Etcher.
• Basic familiarity with the Linux terminal. If you are new to Kali, our Essential Kali Linux Commands for Beginners article covers the commands you will use here.

Step-by-Step Password Reset

1. Boot from the Kali Live USB

Insert the USB drive, restart, and enter the boot menu (usually F12, F2, or Esc during startup). Select the USB drive and choose “Live (persistent, if enabled)” or just “Live”. Kali will load into a desktop environment without touching the internal hard drive.

2. Identify the Windows Partition

Open a terminal and run sudo fdisk -l to list partitions. Look for the Windows partition—typically NTFS, around 100–500 MB for the system reserved one, and a larger one (the C: drive). The Windows system partition is usually /dev/sda2 or /dev/sda3, but it varies. Note the exact device name, e.g., /dev/sda2.

3. Mount the Windows Partition

Create a mount point and mount the partition:

sudo mkdir /mnt/windows
sudo mount /dev/sda2 /mnt/windows

If the partition is BitLocker‑encrypted, you will need the recovery key—the method below does not bypass BitLocker. For unencrypted systems, continue.

4. Locate the SAM File

The SAM (Security Account Manager) file resides inside Windows/System32/config. Navigate there:

cd /mnt/windows/Windows/System32/config

You should see files named SAM, SYSTEM, SECURITY, etc. The SAM file holds the password hashes.

5. Use chntpw to Clear the Password

The chntpw tool is pre‑installed in Kali. Run it against the SAM file:

sudo chntpw -l SAM

This lists all local user accounts. Note the RID (relative identifier) of the account you want to reset—usually 0x01f4 for the built-in Administrator, or a different RID for your own account. Then run:

sudo chntpw -u <RID> SAM

Replace <RID> with the actual number, e.g., 0x01f4. A menu appears:

• 1 – Clear (blank) user password
• 2 – Set a new password (limited to 14 characters)
• 3 – Promote user to administrator (useful for standard accounts)
• q – Quit

Choose option 1 to clear the password. Confirm when prompted. The tool writes the change to the SAM file.

6. Unmount and Reboot

Exit the tool and unmount the partition:

cd ~
sudo umount /mnt/windows

Remove the USB drive and reboot the computer. Windows will start, and the login screen will appear. For the account you cleared, click the user icon—no password is required. Once logged in, immediately set a new, strong password from the Windows settings.

Important Caveats and Safety Checks

• BitLocker: If the Windows drive is encrypted with BitLocker, this method will not work. You must have the recovery key or disable BitLocker beforehand.
• UEFI Secure Boot: Some systems with Secure Boot enabled may refuse to boot Kali from USB. You may need to disable Secure Boot temporarily in the UEFI settings.
• Windows 11 and TPM: Recent Windows 11 builds do not prevent SAM editing offline, but after resetting the password, you may be prompted to set up a PIN or Windows Hello again. That is normal.
• Account Types: This method works for local accounts only. Microsoft accounts (cloud‑linked) cannot be reset this way; you would need to recover the Microsoft account online.

Why This Is a Legitimate Learning Exercise

Understanding how offline credential manipulation works reveals a fundamental Windows authentication flaw: anyone with physical access and a bootable Linux USB can bypass the login screen if the drive isn't encrypted. As a developer or security learner, you can use this to push for BitLocker and BIOS passwords in your environment.

Once you're back in, head to Windows settings and create a password reset disk—it'll save you from this hassle next time. If you want to dig deeper, look up how the SAM file stores NTLM hashes; understanding that vulnerability is a strong argument for enabling full-disk encryption on every machine you manage.