Aller au contenu

Windows password lost

Reset Forgotten Administrator Password on Windows Server Domain Controller (VMware Lab)

This guide explains how to recover access to a Windows Server 2022/2025 Domain Controller running in a VMware Workstation VM when you have forgotten the Administrator password.

Tested scenario — Single DC lab environment, no backup, no other admin accounts available. Warning

This method uses the Windows installation ISO and temporarily modifies system files.

Make a snapshot/backup of your VM before starting.

Prerequisites

  • VMware Workstation with your Windows Server VM powered off

  • Windows Server 2022 or 2025 ISO (evaluation version available from Microsoft)

  • Basic comfort with Command Prompt and diskpart

Step 1 – Mount ISO and Boot into Recovery Environment

  1. Edit VM settings → CD/DVD → Use ISO image file → select your Windows Server ISO

  2. Ensure CD/DVD is connected and set to connect at power on

  3. Power on the VM and boot from the ISO (press any key if prompted)

  4. On setup screen: click Next → Repair your computer (bottom left)

  5. Choose Troubleshoot → Advanced options → Command Prompt

You are now in Windows Recovery Environment (WinRE / Windows PE).

The system drive letter is usually NOT C: here.

Step 2 – Locate the Windows System Drive

Quick method – Try common letters

dir D:\Windows dir E:\Windows dir F:\Windows dir G:\Windows dir H:\Windows dir I:\Windows dir J:\Windows dir K:\Windows dir L:\Windows

When you see System32, WinSxS, Users → note the letter (example: E:)

Recommended method – Use diskpart

diskpart

Then run: 

list disk
list volume

or shorter: 

list vol
Identify your Windows volume:

Largest NTFS volume (usually 50–200 GB+) Fs = NTFS Label often empty, “OS”, “Windows”, etc. Letter (Ltr) often blank

Example output: 

Volume ###  Ltr  Label        Fs     Type        Size     Status     Info

Volume 0     D   Windows S... NTFS   Removable   8000 MB  Healthy
Volume 1         NTFS   Partition   100 MB   Healthy    System
Volume 2         NTFS   Partition   500 MB   Healthy    Hidden
Volume 3         NTFS   Partition   120 GB   Healthy             ← This one!

Select and assign letter: 

select volume 3
assign letter=Z
exit

Verify: 

Z:
dir

You should see Windows, Program Files, etc.

Step 3 – Replace utilman.exe with cmd.exe

Using your assigned letter (example Z:): 

Z:
cd Windows\System32
ren utilman.exe utilman.exe.bak
copy cmd.exe utilman.exe
exit

Restart the VM normally (remove ISO from CD/DVD in VMware or boot from disk).

Step 4 – Open CMD at Login Screen

Reach the Windows login screen

Do not enter password

Press Windows + U

OR click the Ease of Access icon (wheelchair symbol, bottom right)

→ Command Prompt should open with SYSTEM privileges.

Step 5 – Reset the Password

In the CMD window: 

net user Administrator NewStrongP@ssw0rd2026!

(or for a custom username): 

net user Samuel NewStrongP@ssw0rd2026!

Activate account if needed: 

net user Administrator /active:yes

Close CMD → log in with the new password.

Step 6 – Clean Up (Security – Mandatory)

Once logged in, open elevated Command Prompt: 

cd C:\Windows\System32
del utilman.exe
ren utilman.exe.bak utilman.exe

Reboot to verify.

Optional: Reset DSRM Password 

ntdsutil
Then type: 
set dsrm password
reset password on server null

Enter new password twice → q twice to exit.

Troubleshooting

Win + U does nothing → Method blocked on patched systems → try alternative tools (ntpasswd ISO, etc.)

Wrong drive → Re-check size and NTFS in list vol

Access denied → Ensure CMD is from login screen (SYSTEM context)

Good luck with your lab! Last updated: February 2026