How to get administrator password without changing it

Question

_{Friday, July 22, 2016 1:51 AM}

Hello everyone,

I've a very specific question and I wasn't able to find the answer so far. I have full administrator rights on windows 10 account which is connected to domain. There is a second account on same PC with admin rights and this second account is created as a local under the above admin account. When I go on the setting - I can easily manage those two accounts, I can remove them, change password, etc. But my question is how can I access the second account from a backdoor and get in, without changing its password. 

Examples:

First administrator account - george-pc in domain abvhome.hts-cg.com

Second admin account - mirel-pc in local domain -> george-pc

Both are on same system running Windows 10 Pro and one of the accounts is used for local access and the second is for remote access purpose. 

All replies (2)

_{Saturday, July 23, 2016 4:31 PM ✅Answered}

If the password for the local account is unknown you will need to reset it. There is no way to decrypt that password.

_{Sunday, July 24, 2016 6:00 PM ✅Answered}

Hi,

Please know that resetting password is performed by lsass.exe which has the system permission to read and write SAM.

It's not a good thing to block this feature, please considering the scenario once you forget the admin password, it can help to get back your account more efficiently.

If you really would like to do so, I think the workaround is to control the ACL for lsass.exe or System32\config\SAM file on certain admin account. Please know that i haven't test this, just an idea.

Please mark the reply as an answer if you find it is helpful.

If you have feedback for TechNet Support, contact [email protected]