Administrator Login to Access User Data

Question

A company is worried about data on a computer for a top management employee. They will terminate the employee this week. They are not sure if they have the users latest login password. It is not on a domain and is a local account. Normally all our computers have a administrator account for IT purposes but not this one. (I've already used the word 'stupid' in a number of conversations for this not going through normal IT SOP.)

The question -

• can I boot this computer to a USB with Windows 11 Pro
• goto the CMD prompt and make the administrator account active
• and from here reset the user password?
• we don't necessarily need the data but be able to access a application that is run on this computer

Thanks.

Answer 1

Yes, access is possible, but not in the exact way described.

Key points from the scenario:

• The PC is standalone (not domain-joined).
• The only user is a local account whose password may be unknown.
• There is currently no separate local administrator account configured for IT.

From the provided information, the supported and documented options are:

1. Use another existing administrator account (if any) to reset the local password
   If there is any other local administrator account on the PC that can still sign in, that account can reset the top management user’s password:
   1. Sign in with the working administrator account.
   2. Open Computer Management.
   3. Expand Local Users and Groups > Users.
   4. Right-click the target user account and select Set Password….
   5. Enter and confirm a new password. This allows access to the user profile and installed applications under that account.
   If there is no other administrator account that can sign in, this method is not available.
2. Enable the built-in Administrator account (if you can sign in or use Safe Mode)
   If the built-in Administrator account exists but is disabled, and there is some way to sign in (for example, Safe Mode still allows Administrator logon even when disabled), it can be re-enabled and then used to reset the user’s password: a. Log on in Safe Mode as Administrator (when the local Administrator account is disabled):
   1. Restart the computer and press F8 after POST to open Windows Advanced Options.
   2. Select Safe Mode and press Enter.
   3. Select the OS and log on as Administrator.
   4. After Safe Mode loads, open Computer Management.
   5. Expand Local Users and Groups > Users.
   6. Right-click Administrator > Properties.
   7. Clear Account is disabled and click OK.
   After this, restart in normal mode, sign in as Administrator, and then reset the user’s password via Computer Management as in step 1. On a domain controller this would be done with:

      net user administrator /active:yes
   

   but for a standalone client, the GUI method above is the documented approach when you can get into Safe Mode.
3. If no administrator access is available at all
   If:
   • There is no other local administrator account that can sign in,
   • Safe Mode does not allow logon as Administrator,
   • And there is no way to authenticate as an administrator,
   then the documented path for a local account is to reset the device, which will remove data and applications on that installation. For local accounts, if no admin account is available to reset the password, the guidance is to reset the PC. This means that if the data or application configuration on that machine is critical and no admin credentials can be obtained, there is no supported way in the provided documentation to bypass the local account password while preserving data.

Regarding the specific idea of:

• Booting from a Windows 11 USB,
• Opening Command Prompt in Windows RE,
• Enabling the built-in Administrator and resetting the user password from there:

The provided documentation does not describe or endorse enabling the built-in Administrator or resetting local user passwords directly from Windows Recovery Environment/USB boot using offline registry or similar techniques. The supported methods shown are:

• Using Safe Mode to log on as Administrator even when disabled, then re-enabling it.
• Using an existing administrator account in normal mode to reset another local account’s password.
• Resetting the device if no admin account is available.

If access to the application and data is required, ensure that at least one local administrator account can sign in (via Safe Mode if necessary), then use that account to reset the user’s password.

---

References:

• How to access the computer after you disable the administrator account
• Change or reset your password in Windows
• Enable and disable the built-in administrator account
• User Account Access in Windows
• Local Accounts

Answer 2

Hmm.. This is definitely not ideal.

Is this user (who's leaving soon) the only user on this computer, and the only admin user?

Since the computer is not in domain, unfortunately you cannot use another computer to help with this.