Question on recovering a password

[SgtB]

We aquired a server from another company, and they left us without the password. After they set it up here, I was able to change the administrator password, and am now able to logon locally as administrator to the machine....where's the problem you ask?
Unfortunatly a certain application on there needs to run under a certain user name. This user name was a member of the domain this server belonged to. Since this server wasn't a bdc or pdc, I cannot change the password for that username.
A profile for that user is still in the profile directory, so I'm hoping the logon info is still cached. Question is....
Can I access/change this cached info (particularly the password)? I need to logon to as this user in order for the app to work.

Thanks! ________________________________________
Check out

http://www.security-forums.com

 

[wolluf]

Can you create a new local user with that username, and run it from there?

 

[Dogers]

why does it need to be run under a certain username? what does it access? if its a file, you can change permissions, if its registry, then unless its a terminal server you got, youll have to find the computer it ran on..

 

[SgtB]

Dogers - Its a custom application (yippee) and I have no idea why the username would make a difference but it does. We don't have any documentation on the app either.

wolluf - Great idea...I'll give that a shot today and get back to you. ________________________________________
Check out

http://www.security-forums.com

 

[Dogers]

hmm, well, if the local username doesnt work, have a look round sysinternals site (i believe its .com) and check out Process Explorer - this little puppy will tell you exactly what regkeys and files processes are using.. You might also want to pick up NTRegMon - this will give you more details about whats being accessed in the registry (reads/writes, etc)

hope you figure out what its doing

 

[SgtB]

Thanks Dogers, I'll take a look around there. ________________________________________
Check out

http://www.security-forums.com

 

[wolf2x]

SgtB,

Since you have access to the Sam database, you can try l0phtcrack to try to recover the password for that user. A google search should turn up some sites where you can download the file.