|"SAM file is located at:|
e.g. - c:\windows\system32\config\sam"
Aha ! - NOT *.sam
There is also a default backup of it in %SystemRoot%\Repair
e.g. - C:\Windows\Repair\SAM
It has the same date as when I installed Windows MCE 2005 on that computer.
Presumably, you could replace the current user SAM with the \Repair SAM ??
- you can't access the current user SAM, or SAM.log, in the currently running XP user - in use or similar .
- you CAN access the ......\Repair SAM , but in Notepad it has very little text in it, and a few small square boxes - that doesn't account for the file's 24kb size.
- since my friend's XP MCE 2005 computer is set up to be dual bootable with Vista, via a third party boot manager program, I can see the XP Windows partition in Vista, so I tried booting Vista to see if I could read either SAM file - no go - Access Denied.
I can Copy them to other places in Vista, then Delete the copy. I did NOT try deleting them where they are in the XP installation in Vista, or copying one to paste and replace the other, or cutting then pasting them elsewhere.
- Since neither Windows installation has any passwords, I'm not sure whether using the "Take Ownership" procedure would work, if there is one for Vista, if you used that procedure in Vista - I would think it doesn't - to access (open) the SAM files.
So - if you can access and read the user and default SAM files in another non-Microsoft operating system,
- you could Edit the user 's SAM file to eliminate or change the password in it ?? It appears, from what I saw in the the ....\Default SAM file, that it would not be fully readable in a plain text editor similar to Notepad - you would need to use something else.
- you could replace the user that has the unknown password SAM with the \Repair SAM ??
"In NT days if one was to delete the SAM file and then ran a repair routine the SAM was re-established, and with fresh Admin account (no password set either...)
I think the same applies to W2K and possibly XP???"
I have no idea.
I know nothing about NT, other than 2000 was the successor to the last version of it, and XP is the successor to 2000 plus some other features.
"Incidentally there is backup of the original registry files on the root of the drive/partition too... Possibly that can be used to restore the system to a more normal a working state (and restore the original Admin account too...). This M$-KB allows one way to this end?"
Aha! That's where I now remember seeing SAM before ! It's in the same ...\config\... folder!
That procedure is something I've done three times, on three other people's XP installations.
- you can't use the procedure unless you could access Administrator (or whatever it might have been re-named to) in Safe mode before the error happened, whether you were aware of that or not. If you can't access Administrator (or whatever it might have been re-named to), you can't use the Recovery Console features when you boot from an XP CD.
In all three of my cases, the Administrator had no password.
- you CAN get away with replacing ONLY the one file you got a message about being corrupted or missing in .......\config\... on a non brand name system XP installation that had Windows installed on it from a regular CD.
E.g. in one case, the message was about
.....\config\SYSTEM . I replaced only the SYSTEM file with the default, the computer then booted normally The only thing that seemed to be missing was the recognition of the drivers for a network adapter had been installed - I installed the drivers for it again.
- BUT you CAN'T (in most if not all cases) get away with replacing only one file on a brand name XP installation - you have to either......
- replace ALL of the files listed there,
- or, a much better choice, if you could access Administrator (or whatever it might have been re-named to) in Safe mode before the error happened, whether you were aware of that or not, run the second Repair choice (Repair Setup) after booting with the regular XP CD or the brand name's equivalent XP Recovery CD.
- If you replace ALL of the files in the article, your system WILL then boot fine, but you will have to re-install or re-set a LOT of stuff.
E.g. I replaced just SYSTEM on my sister's Sony desktop system. I then got a DIFFERENT error - System error: Lsass.exe - that prevented Windows from booting. As I recall, if I hadn't been able to access the system from another computer (or, probably, it could be done from another operating system on a bootable disk), and hadn't copied the corrupted SYSTEM file to elsewhere rather than deleting it ( the kb article tells you to copy it to elsewhere before you delete it from the user location - I used a shorter other path - I didn't like the idea of copying it to a tmp folder), I would have been screwed at that point. I couldn't get to the second Repair choice in Setup when I booted with the XP CD at that point.
I moved (copied, deleted the one in the user ) the default SYSTEM file from where I had put it back to it's backup location, and copied the corrupted SYSTEM file to the user location where it was in the first place, the original error situation was restored, then I was able to run a Repair installation (Repair Setup) from the XP CD.
I looked on the web and found that was the case with most if not all brand name XP installations.
So - you COULD replace ONLY the user SAM with the .....\Default SAM using that procedure, quite probably IF the the XP installation is NOT a brand name installation, and IF you can access Administrator (or whatever it might have been re-named to), whether you were previously aware of that or not, when you run the procedure.
Otherwise, it appears you would have to use another non-Windows operating system to do that, and even then it may NOT work for a brand name XP installation, if you try replacing ONLY SAM .