Originally Posted By: pca
Hi.

Some background info. A friend of a friend recently died rather unexpectedly, at a fairly young age. His wife needs to get access to his paypal and ebay accounts for the business he ran. Unfortunately he doesn't seem to have left the details for them anywhere easily accessable.There is a decent chance that his accounts are logged in on his windows box, or the passwords are stored there, but of course, THAT also has a password on it that she doesn't know...

Now, presuming he didn't use disk encryption, the obvious solution is to plug the drive from the computer into another system, or in fact boot it from a USB stick into linux. Either approach should allow access to the filesystem. But if things are not quite that easy, is there any viable method to bypass the password on a modern windows system?

I'm not certain which flavor of windows it is running, but knowing the man it would almost certainly be either windows 7 or windows 10. Nothing earlier, certainly, and he didn't like Win 8 smile

Any suggestions?

pca

I unlock Windows machines all the time. It's surprisingly easy. This is my favorite technique. The tl;dr version is that you use a Windows 10 install disk or drive to get a command prompt. Then you replace the utilman.exe file (backing it up first) with cmd.exe. Then you restart and at the login screen you click on the Utility Manager icon at the lower left (that nobody has ever used ever) and it launches a command prompt where you can create an admin account, log in as that account, and change the passwords on the other user(s).

Other than that, I also use the Nirsoft tools listed by Christian, especially Mailpassview (which you'll need to download using Internet Explorer because Chrome doesn't want to let a tool like that through wink ).

*edit*
Note that the above method doesn't work if it's a Microsoft account on Windows 10, just a local account. If it's a Microsoft account then I hope you have access to their email account in some way...


Edited by Dignan (06/02/2019 15:00)
_________________________
Matt