I'm recovering a Windows Server 2016 VM whose computer account is out of sync with the domain, and cached credentials aren't working. We use LAPS, but the current LAPS password is invalid and our setup may not retain password history. I previously used cd140201.iso to reset the local password, but I can't get that ISO to boot on this Hyper-V VM. Secure Boot is disabled and the virtual DVD drive is first in the boot order; I've also tried pressing a key during startup. The Windows Server 2016 installer and UBCD boot successfully, but this particular ISO does not. What are my best recovery options?
4 Answers
You can use the working Windows Server ISO or another WinPE environment instead of the password-reset ISO. Open Command Prompt from recovery, identify the Windows volume, and load its SYSTEM registry hive. For example, if Windows is on D:, run: reg load HKLMTempHive D:WindowsSystem32configSYSTEM, reg add HKLMTempHiveSetup /v CmdLine /t REG_SZ /d cmd.exe /f, reg add HKLMTempHiveSetup /v SetupType /t REG_DWORD /d 2 /f, then reg unload HKLMTempHive. After rebooting, a SYSTEM command prompt should appear, where you can use the normal net user and net localgroup commands to create or enable an authorized local administrator account. Restore the setup registry values afterward and document the recovery.
The accessibility replacement approach is sometimes suggested for local recovery, but endpoint security may block or terminate the resulting command prompt, and it leaves a system-file modification that must be undone. A supported WinRE or WinPE workflow, a backup-platform recovery environment, or assistance from the security/domain administrators is safer for a recovered production server.
If the disk is not protected with BitLocker, the Offline NT Password & Registry Editor is another option for creating or resetting a local account. Since the ISO itself will not boot, first check whether the VM is Generation 1 or Generation 2, confirm the virtual DVD is attached, and verify that the image is compatible with the VM firmware. A Veeam recovery ISO may also provide an administrator-password recovery workflow if your environment uses Veeam.
A recovery toolkit such as Hiren’s BootCD can work on a member server, provided it isn’t being used to modify a domain controller. Its NTPWEdit utility can alter the local SAM database to reset or enable a local account, but use it carefully and only with authorization because incorrect changes can make the installation harder to recover.
Thanks, I’ll try that using the Server installer since it boots correctly.