Let me preface the following with DON’T DO ANYTHING STUPID WITH THIS INFORMAION! RENEHASP.COM IS NOT RESPONSIBLE IF YOU GET FIRED AND OR GO TO JAIL FOR BEING AN IDIOT! THIS IS A BACKDOOR OPTION FOR ADMINISTRATORS THAT FORGOT A LOCAL ADMINISTRATOR PASSWORD ON ONE OF THEIR VIRTUAL SERVERS.

-RENEHASP

I setup a new Windows 2000 server and I mistyped the Administrator Password. What now!! In the real world I use ERD commander. In the Virtual world it didn’t work so well because ERD wants specific drivers. I told my co-worker (Faisal) about my dilemma and he suggested trying a Linux based boot CD. So my search started.

I have Daemon tools installed so I can locally mount any ISO image and it emulates a cd or dvd-rom drive with the mounted image.

You can download Daemon Tools for free from the following address..

http://www.daemon-tools.cc/dtcc/download.php?mode=ViewCategory&catid=5

I found a cool boot cd with a bunch of tools included in it called Hiren’s Boot CD. You can download it for free from here.

HTTP (mirror #1): Hiren‘s BootCD v9.1 incl. keyboard patch
HTTP (mirror #2): Hiren‘s BootCD v9.1 incl. keyboard patch
HTTP (mirror #3): Hiren‘s BootCD v9.1 incl. keyboard patch
HTTP (mirror #4): Hiren‘s BootCD v9.1 incl. keyboard patch
Torrent (mirror #5): Hiren‘s BootCD v9.1 incl. keyboard patch
Torrent (mirror #6): Hiren‘s BootCD v9.1 incl. keyboard patch

Now that you have the CD we can have some fun and restore a long lost virtual server administrator password.

Here is my server that I forgot the local administrator account.

I simply turn off the virtual server

Go to File then Exit from Virtual Infrastructure client.

Now click on your Virtual Infrastructure client but don’t log in. We have a couple of changes to make. (The reason behind this is that if you have a dual core or quad server it boots so fast that you won’t have an opportunity to go into network boot.)

You get this little message just hit OK to it and it will disappear.

Now check your CD/DVD drive settings

You want it setup to the Client Device. We are going to mount the ISO locally and pass it through to fool ESX into thinking the cd is in a Physical drive with the help of DEAMON TOOLS.

Switch to Console view.


This is the hardest part! HIT, CLICK ,TAP!!!

1. Hit the power on button
2. Click in the black box and
3. Tap the ESC key once when the VMware boot screen flashes.

Here are the screen shots.

Click into the black box. Nothing will happen for a second.

Then this screen blinks. You have 2 seconds to tap the ESC key. (If you missed it then hit ALT and Ctrl together to release the mouse and restart the vm and try again)

You will have to use Daemon Tools (Download Info is on top of this post.)

On your Desktop

Right Click on the Daemon Tools tray ICON. Go to Virtual CD/DVD-ROM then your Virtual Device. In my case it’s the E: drive

Choose Mount image.

Browse to the path where you downloaded the Hiren’s Boot CD and click open.

Go back to your Vmware console and click on the Virtual CDROM(ide0:0) and choose Connect E: (That’s where I just mounted the ISO)


Now look back into your console windows and click into it with the mouse.

Down arrow to the CD-ROM Drive option and hit ENTER

Click the down arrow to option 2. Start BootCD.

Click 9 and hit enter.

Click 4 and hit enter.

Click 1 and hit enter.

Choose the ARAPICD driver. Hit enter

Click Yes and hit enter

At this point it will try to load all different drivers until you get this screen.

Click NO and hit enter.

Choose 1 and hit enter

Hit enter

This take a minute or two… Just wait and be patient…

Hit Enter

Choose the Administrator account. I typed 0 and hit enter.

Hit Y

Hit Enter

Hit Esc

Hit Esc

Hit Esc

Hit 3 and Enter

Type in Reboot and hit enter.

Windows rebooting J

Do not put any password into it and hit enter.

And we are in!!!!!!!!!!!! Now we can change the Administrator password to whatever we want and hopefully not forget it this time.