> For the complete documentation index, see [llms.txt](https://malcrvz.gitbook.io/the-vx-files/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malcrvz.gitbook.io/the-vx-files/on-premises-pentesting/techniques/removing-windows-user-passwords.md).

# Removing Windows user passwords

For this you need a toolkit USB loaded with a live CD tool as (deprecated, but still functional) "Hiren's Boot" or its spiritual successor (and loaded with tons of useful tools, very recommended!) "Medicat".

{% embed url="<https://medicatusb.com/>" %}

{% embed url="<https://www.hirensbootcd.org/>" %}

There's instructions/scripts to install them on a USB in their webs.<br>

Once you boot the live CD there's a section with various password removal tools that edit the SAM file and let you change/remove the pass easily with a graphical interface. Just select the account you want to remove the password and follow the steps.<br>

{% hint style="warning" %}
If live CD doesn't load directly and BIOS has a password, meaning you can't change boot order, you would need to open the system and remove the CMOS battery located in the motherboard for a couple minutes, so the BIOS resets to default.
{% endhint %}

{% hint style="danger" %}
Be very careful when editing SAM files and never do it on production systems if there's other way, as it can corrupt the file and leave the account inaccessible!
{% endhint %}