NAME

       chntpw - utility to overwrite passwords of Windows systems

SYNOPSIS

       chntpw [options] <samfile> [systemfile] [securityfile] [otherreghive] [...]

DESCRIPTION

       This  manual  page  documents  briefly  the  chntpw command.  This manual page was written for the Debian
       distribution because the original program does not have a manual page.

       chntpw is a utility to view  some  information  and  reset  user  passwords  in  a  Windows  NT/2000  SAM
       userdatabase  file used by Microsoft Windows Operating System (in NT3.x and later versions). This file is
       usually located at \WINDOWS\system32\config\SAM on the Windows file system. It is not necessary  to  know
       the  previous passwords to reset them.  In addition it contains a simple registry editor and  ahex-editor
       with which the information contained in a registry file can be browsed and modified.

       This program should be able to handle both 32 and 64 bit Microsoft Windows and all versions from NT3.x up
       to Win8.1.

OPTIONS

       -h     Show a summary of options.

       -u username
              Username or username ID (RID) to change. The default is 'Administrator'.

       -l     List all users in the SAM database and exit.

       -i     Interactive Menu system: list all users (as per -l option) and then ask for the user to change.

       -e     Registry editor with limited capabilities (but it does include write support). For a slightly more
              powerful editor see reged

       -d     Use buffer debugger instead (hex editor)

              -L Log all changed filenames to /tmp/changed. When this option is set  the  program  automatically
              saves the changes in the hive files without prompting the user.

              Be  careful  when using the -L option as a root user in a multiuser system.  The filename is fixed
              and this can be used by malicious users (dropping a symlink  with  the  same  name)  to  overwrite
              system files.

       -N     Do not allocate more information, only allow the editing of existing values with same size.

       -E     Do not expand the hive file (safe mode).

       -v     Print verbose information and debug messages.

EXAMPLES

       ntfs-3g /dev/sda1 /media/win ; cd /media/win/WINDOWS/system32/config/
              Mount  the  Windows  file  system  and enters the directory \WINDOWS\system32\config where Windows
              stores the SAM database.

       chntpw SAM system
              Opens registry hives SAM and system and change administrator account. This will work even  if  the
              name  has  been  changed  or  it  has  been localized (since different language versions of NT use
              different administrator names).

       chntpw -l SAM
              Lists the users defined in the SAM registry file.

       chntpw -u jabbathehutt SAM
              Prompts for password for jabbathehutt and changes it in the SAM registry file, if found (otherwise
              do nothing).

KNOWN BUGS

       This  program uses undocumented structures in the SAM database. Use with caution (i.e. make sure you make
       a backup of the file before any changes are done).

       Password changing is only possible if the program has been specifically compiled with some  cryptographic
       functions.  This  feature,  however, only works properly in Windows NT and Windows 2000 systems. It might
       not work properly in Windows XP, Vista, Win7, Win8 and later systems.

       In the Debian distribution this feature is not enabled.

SEE ALSO

       reged, samusrgrp, sampasswd

       If you are looking for an automated procedure  for  password  recovery,  you  might  want  to  check  the
       bootdisks   (can   be   used   in   CD   and   USB   drives)   provided   by   the   upstream  author  at
       http://pogostick.net/~pnh/ntpasswd/

       You will find more information available on how this program works, including in-depth details on how the
       registry works, in the text files /usr/share/doc/chntpw/README.txt and /usr/share/doc/chntpw/MANUAL.txt

AUTHOR

       This program was written by Petter N Hagen.

       This  manual  page  was  written  by Javier Fernandez-Sanguino <jfs@debian.org>, for the Debian GNU/Linux
       system (but may be used by others).

                                                 13th March 2010                                       CHNTPW(8)