I was doing some research the other day on getting your self out of a difficult situation when you don’t have access to some vital system resources because you are running as a normal user and you lost your local admin password.

I discovered that there is a way to reset your user interface and run interactively as the LOCAL SYSTEM account. This is important because the LOCAL SYSTEM account has a lot of privileges available to it. According to Microsoft:

The system account and the administrator account (Administrators group) have the same file privileges, but they have different functions. The system account is used by the operating system and by services that run under Windows. There are many services and processes within Windows that need the capability to log on internally (for example during a Windows installation). The system account was designed for that purpose; it is an internal account, does not show up in User Manager, cannot be added to any groups, and cannot have user rights assigned to it. On the other hand, the system account does show up on an NTFS volume in File Manager in the Permissions portion of the Security menu. By default, the system account is granted full control to all files on an NTFS volume. Here the system account has the same functional privileges as the administrator account.

A little while back, some enterprising individuals discovered a way to run the LOCAL SYSTEM account interactively. Here are the instructions according to one website:

  1. Start > Run > cmd.exe > type: at 12:03 /interactive “cmd.exe” (replace 12:03 with a time 2 mins from now). > close command prompt
  2. New command prompt will open, when it does > Hit CTRL+ALT+DEL > find explorer.exe and End Process.
  3. At command prompt type: cd.. > type: explorer.exe

This all words fine except that it is a bit confusing for someone who does not understand how all this works. So, I thought I would make it easier for those who do not have my background. I created a little program in AutoIt that completely automated the process. Simply run the program, wait for a couple of minutes, and you’re running as the LOCAL SYSTEM account.

You can download this program and play with it all you want.

WARNING: I have tested this program to the best of my abilities but this does not mean it is perfect. I did not have any problems with it but that does not mean you will not. If something goes wrong, don’t blame me! You’ve been warned.

For those of you who are interested, here is the source code for this little program I wrote. Feel free to hack around and make it do different things:

#include <Date.au3>
If $CmdLine[0] = 0 Then
;No command line options
;First run
$RunTime = _DateTimeFormat(_DateAdd(’n', 1, _NowCalc()),5)
$Command = @ComSpec & ” /c AT ” & $RunTime & ” /interactive “”" & @ScriptFullPath & “”" 2″
Run($Command)
Else
;Second run
$Command = @ComSpec & ” /c taskkill /IM explorer.exe /F & ” & @WindowsDir & “/explorer.exe”
Run($Command)
EndIf

Update: Someone asked in the comments how you get back to your normal account. Simply log out and then log back in as yourself. You should be back to normal.

If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?

Trackback link - http://www.dailycupoftech.com/2008/05/22/access-locked-resources-be-the-machine/trackback/
Tim Fehlman