I'm recovering a Windows Server 2016 VM whose computer account is out of sync with the domain, and cached credentials are not working. We use LAPS, but the current LAPS password is invalid and our setup may not retain password history. I previously used the cd140201 recovery ISO to reset the local password, but I cannot get that ISO to boot on this recovered Hyper-V VM. Secure Boot is disabled and the virtual DVD drive is first in the boot order. I've also tried pressing a key during startup. A Windows Server 2016 installation ISO and another recovery environment boot normally, but this particular ISO does not. What recovery approach or Hyper-V setting should I check?
4 Answers
The ISO itself may be incompatible with the VM’s firmware or virtual hardware. Compare whether the working images boot as Generation 1 or Generation 2 media, try attaching the ISO through the VM’s virtual DVD drive again, and check the Hyper-V boot and firmware settings. If the image is legacy BIOS-only, a Generation 1 VM may be required; if it is UEFI-compatible, verify that the VM’s firmware configuration matches. A supported Windows recovery ISO is usually the safer option.
Since the Windows Server installation ISO already boots, use it to enter Windows Recovery or WinPE and open Command Prompt. First identify the Windows volume, then use an authorized offline recovery procedure to repair access or create a temporary local administrator. Be careful when editing the offline registry, and restore any temporary changes afterward. This avoids depending on the older recovery ISO.
A bootable toolkit such as Hiren’s BootCD or NT Password Edit can modify the local SAM database and reset a local account, provided the disk is not protected by BitLocker. Use this only with proper authorization, because directly changing the SAM or registry can make the installation unstable and may have security or audit implications.
That is the toolkit I was trying to use, but its ISO refuses to boot even though the other images work.
If the VM is not BitLocker-encrypted, another option is to use a vendor-supported recovery environment or a Veeam recovery ISO, since some backup platforms include authorized local administrator recovery tools. After regaining access, repair the domain trust relationship and rotate the local administrator credential through LAPS rather than leaving a temporary account or password in place.
Thanks, I’ll try using the Server installation media to access recovery tools instead.