Local user accounts

<< Click to Display Table of Contents >>

Navigation:  System and Data Recovery Programs > Elcomsoft System Recovery > Program information > How to use the program >

Local user accounts

If you work with local (SAM) accounts, you will be presented with a list of all local accounts after selecting the operating system or SAM and SYSTEM files:

 

sam_accounts

 

 

The accounts that have Administrator privileges are highlighted in green. Accounts that are locked or disabled are colored red.

 

You can enable the Show password hashes option to see LM and NTLM hashes for all accounts with non-empty passwords, and Show password history option to see old records that are available (if saving the password history was enabled in the system).

 

Select the account you want to change the password or properties for, and press Next:

 

sam_change

 

 

Here you can reset/change the password as well as the following account properties:

 

Administrator account

Password never expires

Password expired

Account disabled

Account is locked out

 

After you make the changes, press Apply. You will be prompted for the location and name of the backup copy of the SAM database.

 

Caution: do not reset the password with an empty one. For security reasons, select a new, reasonably complex password. Note that a local security policy might be applied. If this is the case, you will be able to set a non-compliant or even empty password, but you may be unable to log on with that new password if it does not comply the password policy. Finally, you cannot give Administrator privileges to built-in accounts such as Guest; it is also not recommended to change the password or any properties for any accounts in the Guests user group.