One of the place that I work at has a few hundreds of computers and it is shared by students. Each student has their own user account which is a limited user account. Sometimes the lecturer there will complain to me that the administrator password has been hacked and changed by the students. This can be easily done if they did not set a security password for BIOS and allows the student to boot up the computer with a CD that is equipped with a tool to reset any local user account’s password.

When the teachers reported to me that the students managed to turn a limited user account into a computer administrator, my guess was the students reset the administrator password, login as admin and changed the account type to administrator.
Turn limited account to computer administrator
But I was wrong. It turns out that the students did not reset the admin password and they were able to do it without logging in to Windows as administrator. After a little searching, I found a free tool that can change a Windows XP limited user account into a computer administrator.

PCLoginNow is an easy-to-use tool to reset local administrator and other accounts passwords on Windows system. No need to reinstall the system. It resets Windows passwords and Windows security settings instantly. All version of Windows are completely supported. It’s an incredible CD for Home users and Businesses. And most of all, it’s the most popular and safe solution for removing your Windows password until now.

Besides the abilities of resetting passwords, PCLoginNow can also help you maintain, change accounts policy setting and properties. You can easily upgrades an general account to administrator level, lock or unlock those accounts you don’t need anymore, And moreover, all of these are done without booting your tedious, time-consuming Windows System.

The most powerful feature PCLoginNow have is to support Syskey. SYSKEY is an optional feature since Windows NT 4.0 SP3. It is meant to protect against offline password cracking attacks so that the SAM database would still be secure even if someone had a copy of it. Even though the system registry is protected by Syskey, PCLoginNow can easily bypass this mechanism and reset the Windows passwords.

Only 4 simple steps are required to turn a limited user account into administrator.
1. Download PCLoginNow.

2. Burn the ISO image to a CD/DVD.

3. Boot up the computer with the CD/DVD.

4. Click the Next button when you see the message that says “PC Login Now! is ready to start, please click NEXT to continue…”

5. Select the Windows system that is found by PC Login Now program.

6. Select the user account that you want to edit, check “is Administrator” and click Next.
Change Limit User account to Administrator

7. Reboot and the user is now a local administrator of the computer.

I find this tool amazing because it can turn a user from zero into hero. I understand that some students are adventurous and would like to install or configure the system the way they like it but they cannot do it with a limited user account. Hence, they find a way to secretly upgrade their limited account to a local computer administrator and now they can do whatever they want. We cannot set a BIOS password because if the students entered the wrong security password for 3 times, it’ll be locked and we’ll have to contact HP support and get them to reset it. If you have a way to prevent from the students from editing user accounts without logging in as administrator, please share it with me.

Technorati Tags: , , , ,