CHNTPW(8)

💖 CHNTPW 💖

okay so bestie, welcome to chntpw — it's the chntpw manual page from section 8, aka System Manager's Manual. it's a utility to overwrite passwords of Windows systems. yeah. THAT utility. the "i forgot my admin password" main character. 🔥

---

✨ SYNOPSIS ✨

chntpw [options] <samfile> [systemfile] [securityfile] [otherreghive]
[...]

like, you give it options, you give it a <samfile>, and you can keep going with a [systemfile], a [securityfile], an [otherreghive], and honestly as many more as you feel like ([...]). slay. 💅

---

🌸 DESCRIPTION 🌸

so this page documents the chntpw command, but not like, exhaustively — it says right here it's just a brief overview. and fun fact: this manual page was written for the Debian distribution specifically, because the original program doesn't ship with a manual page at all. so we made one. you're welcome. 🫶

chntpw is a utility that lets you view some information and reset user passwords in a Windows NT/2000 SAM userdatabase file — that's the one used by the Microsoft Windows Operating System, in NT3.x and later versions. this file usually lives at \WINDOWS\system32\config\SAM on the Windows file system. and here's the iconic part: you do not need to know the previous passwords to reset them. no cap. it just does it. 😭

on top of all that, it also contains a simple registry editor and a hex-editor, so you can browse and modify the information sitting inside a registry file. two features for the price of one, it's giving multitasking queen. 👑

and it should be able to handle both 32 and 64 bit Microsoft Windows, plus all versions from NT3.x up to Win8.1. periodt.

---

💅 OPTIONS 💅

• -h — show a summary of options. the lil cheat sheet. 🌈
• -u username — the username or username ID (RID) you wanna change. the default is 'Administrator'. yes, default. it just assumes. 🙈
• -l — list ALL users in the SAM database and then exit. no edits, just gossip. 👀
• -i — the Interactive Menu system: lists all users (same as the -l option does) and then asks you which user to change. it's the "let's chat about it" mode. 💬
• -e — registry editor with limited capabilities — but lowkey it does include write support. for a slightly more powerful editor, go see reged. ✨
• -d — use the buffer debugger instead (hex editor). 🔍
• -L — log all changed filenames to /tmp/changed. when this option is set, the program automatically saves the changes in the hive files without prompting the user.

okay bestie listen: be careful when using the -L option as a root user in a multiuser system. the filename is fixed, and that can be used by malicious users (like, dropping a symlink with the same name) to overwrite system files. that's a whole horror movie. 💀

• -N — do not allocate more information; only allow editing of existing values with the same size. no growing. just vibes at the current size. 🍓
• -E — do not expand the hive file (safe mode). 🧚
• -v — print verbose information and debug messages. for the girlies who want the tea. ☕

---

🎀 EXAMPLES 🎀

ntfs-3g /dev/sda1 /media/win ; cd /media/win/WINDOWS/system32/config/

mount the Windows file system and enter the directory \WINDOWS\system32\config, which is where Windows stores the SAM database. step one of the heist. 🔓

chntpw SAM system

opens the registry hives SAM and system and changes the administrator account. and this will work even if the name has been changed or it's been localized — because different language versions of NT use different administrator names. iconic behavior honestly. 👑

chntpw -l SAM

lists the users defined in the SAM registry file. roll call. 📋

chntpw -u jabbathehutt SAM

prompts for the password for jabbathehutt and changes it in the SAM registry file, if found — otherwise it does nothing. sorry jabba. 🐌

---

😭 KNOWN BUGS 😭

this program uses undocumented structures in the SAM database. so use with caution — meaning: make sure you make a backup of the file before any changes are done. i'm not joking, back it up, i'm begging. 🙏

password changing is only possible if the program has been specifically compiled with some cryptographic functions. and even then, this feature only works properly in Windows NT and Windows 2000 systems. it might not work properly in Windows XP, Vista, Win7, Win8 and later systems. so like... adjust your expectations accordingly bestie. 😬

and in the Debian distribution, this feature is not enabled. yeah. it's not on. 💔

---

🦋 SEE ALSO 🦋

• reged
• samusrgrp
• sampasswd

if you're looking for an automated procedure for password recovery, you might wanna check out the bootdisks (they can be used in CD and USB drives) provided by the upstream author at http://pogostick.net/~pnh/ntpasswd/ ⭐

and you'll find more information on how this program works — including in-depth details on how the registry works — in these text files:

• /usr/share/doc/chntpw/README.txt
• /usr/share/doc/chntpw/MANUAL.txt

study up. do your homework. you got this. 📚💜

---

💖 AUTHOR 💖

this program was written by Petter N Hagen. 👑

and this manual page was written by Javier Fernandez-Sanguino <jfs@debian.org>, for the Debian GNU/Linux system (but it may be used by others). sharing is caring. 🫶

---

and that's the whole page, bestie — signed off on the 13th March 2010, from the System Manager's Manual, section 8, and this version of the page is the CHNTPW(8) one. that's a wrap, go back up your SAM file before you do anything. mwah. 💋✨