So, you have lost your Windows Administrator password for your Rackspace cloud server? I’d like to thank my friend Cory for providing the link details for how to do this.
No problem. Simply put the Windows VM into rescue mode using a Linux image (yup!)
Put Windows VM into Rescue mode using Linux image
# Initiate rescue using the CentOS 7 image for the server uuid 0b67faf7-bc56-4844-ad0b-16e39f289ef6 $ nova me rescue --password mypasswordforrescuemodehere --image 7fade26a-0cca-415f-a988-49c021768fca 0b67faf7-bc56-4844-ad0b-16e39f289ef6
If you’ve broken your Rackspace server and you don’t know how to perform the above step, send a ticket to Rackspace support and they should be able to put your server in rescue so you can reset the password of your windows machine!
SSH to rescue server
ssh root@myserveriphere
Check which disk is Windows NTFS
# fdisk -l
Disk /dev/xvdc: 2147 MB, 2147483648 bytes, 4194304 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x0003e9b3
Device Boot Start End Blocks Id System
/dev/xvdc1 2048 4194303 2096128 83 Linux
Disk /dev/xvdb: 85.9 GB, 85899345920 bytes, 167772160 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0xfcb073fc
Device Boot Start End Blocks Id System
/dev/xvdb1 * 2048 167770111 83884032 7 HPFS/NTFS/exFAT
Disk /dev/xvda: 85.9 GB, 85899345920 bytes, 167772160 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x00070dc0
Here we can see that the disk we want is /dev/xvdb1 since this is the HPFS/NTFS/exFAT partition format used by windows. The rescue mode builds a new server and disk, attaching your old disk as the ‘b’ disk, xvdb. Lets mount the disk and install the application we need to wipe the password for the box.
Mount the disk
yum update -y yum install ntfs-3g -y mount /dev/xvdb1 /mnt
Download and install the chntpw tool
curl li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm -o /root/nux.rpm rpm -Uvh /root/nux.rpm yum install chntpw -y
Run tool against Windows Administrator SAM file
Once run press 1 to ‘clear password’.
root@RESCUE-test config]# chntpw -u "Administrator" SAM chntpw version 0.99.6 110511 , (c) Petter N Hagen Hivename (from header): <\SystemRoot\System32\Config\SAM> ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c File size 262144 [40000] bytes, containing 6 pages (+ 1 headerpage) Used for data: 255/20712 blocks/bytes, unused: 13/3672 blocks/bytes. * SAM policy limits: Failed logins before lockout is: 0 Minimum password length : 0 Password history count : 0 | RID -|---------- Username ------------| Admin? |- Lock? --| | 01f4 | Administrator | ADMIN | | | 01f5 | Guest | | dis/lock | ---------------------> SYSKEY CHECK <----------------------- SYSTEM SecureBoot : -1 -> Not Set (not installed, good!) SAM Account\F : 0 -> off SECURITY PolSecretEncryptionKey: -1 -> Not Set (OK if this is NT4) Syskey not installed! RID : 0500 [01f4] Username: Administrator fullname: comment : Built-in account for administering the computer/domain homedir : User is member of 1 groups: 00000220 = Administrators (which has 1 members) Account bits: 0x0010 = [ ] Disabled | [ ] Homedir req. | [ ] Passwd not req. | [ ] Temp. duplicate | [X] Normal account | [ ] NMS account | [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act | [ ] Pwd don't expir | [ ] Auto lockout | [ ] (unknown 0x08) | [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) | Failed login count: 0, while max tries is: 0 Total login count: 15 - - - - User Edit Menu: 1 - Clear (blank) user password 2 - Edit (set new) user password (careful with this on XP or Vista) 3 - Promote user (make user an administrator) (4 - Unlock and enable user account) [seems unlocked already] q - Quit editing user, back to user select Select: [q] > 1 Password cleared! Hives that have changed: # Name 0 Write hive files? (y/n) [n] : y 0 - OK
It’s been done, yay!
Unrescue the cloud server, either from control panel or using nova
abull-mb:~ adam$ supernova me unrescue 0b67faf7-bc56-4844-ad0b-16e39f289ef6
Yay! We now automatically bypass the ordinary login screen so we can get into the server to reconfigure it properly again.
You might have some questions about… setting up nova.
Setting up Nova
# Nova configuration #export OS_AUTH_URL=https://lon.identity.api.rackspacecloud.com/v2.0/ #export OS_AUTH_SYSTEM=rackspace_uk #export OS_REGION_NAME=LON #export OS_USERNAME=mycloudusernamehere # Tenant Name is customer number shown in url of mycloud control panel ##export OS_TENANT_NAME=10101010 #export NOVA_RAX_AUTH=1 #export OS_PASSWORD=mycloudapikeyhere # Project ID is customer number shown in url of mycloud control panel #export OS_PROJECT_ID=100101010 #export OS_NO_CACHE=1
These ‘environment variables’ should be put in a file like your .bash_profile. Then you will want to source it before using nova
source .bash_profile or . .bash_profile
This just sets the variables on the commandline so they can be used by nova. It is possible to provide all of the credentials on the nova commandline as described in previous articles on this blog concerning nova.
Using nova without .bash_profile or environment variables
Initiate Rescue Mode
nova --os-username mycloudusernamegoeshere --os-auth-system=rackspace --os-tenant-name tenantidgoeshere --os-auth-url https://lon.identity.api.rackspacecloud.com/v2.0/ --os-password apigoeshere rescue --password mypasswordforrescuemodehere --image 7fade26a-0cca-415f-a988-49c021768fca 0b67faf7-bc56-4844-ad0b-16e39f289ef6
Un-rescue
nova --os-username mycloudusernamegoeshere --os-auth-system=rackspace --os-tenant-name tenantidgoeshere --os-auth-url https://lon.identity.api.rackspacecloud.com/v2.0/ --os-password apigoeshere unrescue
Installing nova
for more details about how to install python based nova, used in this article, please see;
https://support.rackspace.com/how-to/installing-python-novaclient-on-linux-and-mac-os/