How to Recover Plain-Text Password for Windows Administrator Account

How do I recover the password to Windows admin account? Though you can regain access to a locked account by resetting Windows password with third-party utilities, you'll lose access to all of its encrypted files (EFS), stored passwords, and personal security certificates. If you can't afford to lose such data, you have to recover Windows plain-text passwords.

Password Recovery Bundle is one of the fastest password cracking tools that lets you recover forgotten Windows password using brute-force, mask and dictionary attacks. Compared to other tools, it uses both multi-threading technology and GPU acceleration to improve the password search.

This tutorial will demonstrate how to recover plain-text password for Windows administrator account using brute-force attack. To benefit from GPU acceleration you need a dedicated NVIDIA or AMD graphics card that supports CUDA. Let's get started!

1Install Password Recovery Bundle

1. Click here to download the setup package of Password Recovery Bundle and save it in a place that is easy to find, such as your desktop.
2. When the download is complete, double-click the download file to run the installation wizard. Follow the on-screen instructions to complete the installation.

2 Import the SAM & SYSTEM Registry Files

In order to extract the encrypted passwords, you need to grab both the SAM and SYSTEM registry files from your locked computer. These files are usually located at the following directory:

C:\Windows\System32\Config\

No matter if you can log into Windows, you can copy the SAM and SYSTEM files using Command Prompt or a Live CD. Afterwards, you can import them into Password Recovery Bundle:

1. Start the Password Recovery Bundle program. Click the Windows Password button and then select "Recover Local User Password" from the pop-up menu appears.

   

2. Click the Browse button to select the SAM file you've grabbed from your target machine. Make sure the SYSTEM registry file was placed at the same directory as the SAM file.

   

3. It will display all users in the SAM file. Select the administrator account you want to recover the password for, and click on the Recover Password button.

   

3 Recover Windows Password with Brute-force Attack

1. Choose one of the most common methods of cracking passwords: dictionary attacks, brute force attacks, and masked attacks. Click Next to proceed.

   

   • Brute-force attack - try all combinations and increasing the length until the password is found. This method is extremely fast at cracking short passwords.
   • Mask attack - use the same method as brute-force attack, but are more specific.
   • Dictionary attack - attempt to guess passwords by using well-known words or phrases.

2. If you've chosen the brute-force attack, define your own character sets, as well as the minimum and maximum length of the passwords to be searched. Click Next.

   

3. It will try all possible combinations of given character sets and a password length range, until your Windows administrator password is found.

   

Video Tutorial: