Bypass Windows Password for Virtual Machine Hosted on VMware ESXi

Forgot the local administrator password or domain user password for a Windows VM running in VMware ESXi? In this article, we'll step through the process of using the PCUnlocker utility to bypass forgotten administrator password for Windows virtual machine hosted on VMware ESXi.

If you've enabled UEFI for your Windows virtual machine, you need to use the Enterprise edition of PCUnlocker which supports UEFI booting.

1Change VM Setting from vSphere Client

1. Click here to download and save the PCUnlocker self-extracting Zip file to a folder on your hard drive, then extract the ISO image file: pcunlocker.iso from it.
2. Open vSphere Client and login to your ESXi server using your server's IP and credentials.

3. Select your locked Windows virtual machine on the left pane of vSphere Client. In the Summary tab, right-click the data store and select Browse Datastore.

   

4. You will see an overview of everything in the datastore. With the root folder highlighted on the left, click on the “Upload files to this datastore” button in the toolbar, and then select Upload File. Browse to the pcunlocker.iso file and upload it to the datastore.

   

   If your Windows VM is configured with VMware Paravirtual SCSI controller, you also need to upload the pvscsi floppy image (pvscsi.flp) to the datastore, as PCUnlocker does not recognize the paravirtualized virtual disk due to the lack of native driver support.

5. In the left navigation pane of vSphere Client, right-click on the virtual machine and select Edit Settings.

   

6. In the Virtual Machine Properties dialog, click the Hardware tab and select the DVD/CD drive. Select Datastore ISO file and browse to the pcunlocker.iso file you uploaded to the datastore, and make sure Connect at power on is selected.

   

7. Click Floppy drive under the Hardware tab. Choose Use existing floppy image in datastore and browse to the uploaded pvscsi.flp file. Check the Connect at power on.

   

2Bypass ESXi VM Password

1. To boot from the virtual CD, you need to change the boot sequence of the VM (2 Methods to Change Boot Order of Guest VM in VMware ESXi). Once the boot order is set up properly, power on the VM and the screen will display "Press any key to boot from CD or DVD". Press a key to continue.

   

2. After booting from the CD drive, the VM will load Windows 8 PE and take you to the PCUnlocker program which lists all your Windows local accounts.

   

   If your virtual hard drive is configured with VMware Paravirtual SCSI controller, PCUnlocker will prompt you to choose the SAM file due to the lack of native driver support. You need to click on Options button and select Load IDE/SCSI/SATA/RAID Driver. Browse to the floppy drive (A:\) -> amd64 and load the pvscsi driver.

   

3. Simply select a local account and click on Reset Password, the program will unlock / reset your Windows local password quickly. If you need to bypass a domain admin password, switch to the Reset Active Directory Password mode instead.
4. After password reset, click Restart button to reboot the VM and dismount the PCUnlocker ISO image from your CD drive. You should be able to log into your Windows VM with the password provided by PCUnlocker.

PCUnlocker supports all types of SCSI controllers available in VMware ESXi, including BusLogic Parallel, LSI Logic Parallel, LSI Logic SAS, and VMware Paravirtual.