Windows7- "Hidden" user account and login password problems

I have a client that brought me his laptop for removal of the login password. Apparently, his neighbor's cousin -the computer "expert"- added the password to make the PC "harder to hack when you're on the internet" - yeah, his words, not mine, whatever rolleyes. This expert neglected to write down the password, and cannot remember exactly what the password is. Anyhow- here's the problem: when using the tools I normally use for this (Active Password Changer and/or the 'Locksmith' feature in the ERD/MSDaRT), they do not show the account that is passworded. But if I use a file explorer from a preinstall environment, I can see the account in question. This is confusing; let me clarify: If I browse to C:\Users using the file explorer in ERD/MSDaRT or UBCD4Win, I see the normal "Administrator" account, the normal "Guest" account, an account we'll call "Bob", and an account we'll call "Joe". The password is on the account "Joe". When using a password changing tool, the account "Joe" is not listed, only the normal "Administrator" and "Guest" or "Public" accounts, and the "Bob" account. When I boot to Windows and get to the login screen, the account Joe comes up, but not the account Bob. I'm thinking the "expert" that previously worked on the laptop really screwed up the user accounts and profiles. I'm thinking I can use a remote registry editor (like on the UBCD4Win) and perform a reg edit similar to these steps to fix the account(s).

Any ideas, thoughts, suggestions will be appreciated!

 

Not sure about the reg fix but you might want to try PClogin and see if it detects all of the accounts. If it detects the account, just check the box marked password is empty. This clears the password. If the "expert" used EFS to encrypt the files of the account then resetting the password would cause all the encrypted files to be inaccessible.

http://www.pcloginnow.com/
http://pcsupport.about.com/od/toolsofthetrade/ss/pcloginnowsbs_11.htm

Trinity Rescue Kit may find the accounts also.

http://trinityhome.org

http://www.techtip.org/how-to-reset-your-locked-windows-password/

 

Thanks tgell, but the PC LoginNow program errored out shortly after booting to the CD: "!!Invalid loop location: /root.dat. !!Please export LOOP with a valid location, or reboot and pass a proper loop=.. !!kernel command line!" Each time you see "!!" is the start of a new line of text. I haven't checked out the Trinity kit yet, heading there now.

I was unable to use the remote reg edit because the PC crashes to a BSOD when I try to boot to the UBCD4Win. I'm going to run a few hardware diagnostics on this thing too - too much weirdness.

 

I wonder if you would get the same BSOD if you used PCregedit? But that is based on linux also.

 

The TRK didn't show all the accounts, but I used it to remove the password from the "Bob" account. I then booted to the login screen, and clicked on "Switch User" that I didn't notice before. I was then shown an empty user picture window named "Other user". Strange. I clicked it, typed in "Bob" and was able to log in. So I went to the Control Panel > User Accounts and the "Joe" account is still not listed. So, what I'm looking for now is the Windows7 equivalent of control userpasswords2 from WinXP.

 

Either of these:
WinKey+R > control userpasswords2
Start > Search > netplwiz

 

I was wondering if maybe you could get to the hidden user account like the hidden administrator account in Windows 7. Just a thought. Not sure it will work though.

At an elevated command prompt type:

net user <user> /active:yes

 

go to control panel-folder options-view-show hidden files and folders.if this doesnt work try the more complicated method.check the registry for special accounts. do this by opening command prompt and type regedit.exe this is the normal registry editor(open command promt through Run-cmd)then open the following folders in the exact order Computer-HKEY_LOCAL_MACHINE-SOFTWARE-Microsoft-Windows NT-Current Version-Winlogon-Special Accounts-Userlist. Alist of names and values should come up on the right side of the window look for the account name you want(Joe) or the name that was given to the account when it was created, and delete the value(Right click delete) only delete if you that its it for sure and dont delete anything else. Good luck.