Windows 10: You can bypass admins privileges as a standard user by just using Startup repair & Notepad?

I did some poking around and I found a way to give a standard user with limited rights admin privileges without the admin password or even network admin password. It involves enabling the hidden admin via executing the command line (CMD) with admin privileges in the logon screen and it begins with notepad. This is especially useful if your profile is heavily controlled and can't access windows services without an Administrator password or if you want to remove a computer from a network domain. As you may or may not know the 'Hidden Administrator' has complete control over the PC and can override other admins, change passwords, elevate other user's privileges, etc. This is how I did it...

1. 
   Force shutdown the PC when the windows logo displays on startup. You can do this by switching off from your UPS or mains power switch. (This works on desktop but I haven't been able to confirm on a laptop.) Do this another 2-3 times until the PC launches into 'Startup Repair' menu. (This is the only method that works as launching startup repair through Settings>Update & Security>Recovery>Advance Startup will prompt for an admin password when you try and access CMD)
   
   
2. 
   When startup repair launches, click on the 'Troubleshoot' tab > Then click on the 'Advanced Options' tab. > Then click on the 'Command Prompt' tab.
   
   
3. 
   When command prompt opens, type 'notepad'.
   
   
4. 
   When notepad opens, Click on the 'File' drop-down menu > Then click 'Open' > Then open 'This PC' > Then open your local drive.[It will most likely it will be Local Disk (C but in startup repair, it will be moved a letter down and renamed Local Disk (D due to the boot drive temporarily taking the position of Local Disk (C]
   
   
5. 
   When you open your local drive open 'Windows', then open 'System32'. Ensure that it searches for 'All Files' and not just '.txt' files. Then find the executable file called 'sethc' and rename it the 'sethc-old'. Then find the executable file called 'cmd' and rename it to 'sethc'. ['Sethc' is the executable for the accessibility feature called 'Sticky Keys'.]
   
   
6. 
   Then exit Startup Repair and start the PC as normal.
   
   
7. 
   When the logon screen appears, click the 'Ease of access' button which is to the left of the Power button then switch ON the 'Sticky Keys' option. Then press the 'Shift' key five times quickly and CMD should open with Administrator Privileges.
   

From here you can do pretty much anything if you're familiar with command line (CMD) commands.

1. If not you can enable the hidden admin account by typing net user administrator /active:yes then give the new admin a password by typing net user administrator \* then confirm the password and voila! Close CMD and you can now login to the hidden admin account. You can access and manipulate any account other on the PC to your will.

I wasn't sure what flair to give this post so forgive me if 'Bug' doesn't suit it.

submitted by /u/CarFreak777
[link] [comments]

:)

 

admin password?

You can reset the Admin Password using Windows XP repair; See Here for step by step.

*Toast :toast:

 

Need help with Admin privileges


That's what puzzles me, I am logged-in as (my username) but still won't give me admin privileges. I checked under control panel/users amd it shows me as a local account. Tried to right click on CMD prompt but the "RUN AS ADMINISTRATOR" doesn't show up

 

Allow Standard User run application as admin

we have a shortcut that is calling a .exe file that requires admin rights by the UAC. I would like to be able to run the application without any admin rights or give the standard user admin rights only to this .exe. What we have done and failed.

1. Application properties >> security >> Advanced >> Permissions >> Full Control
   
   to local group A (which includes the user) and user by them self.
   
   1. Gave ownership of folder to local Group A.
      
   2. I looked in Regedit and I see the user, and they have full control for that application.
      
   3. have checked run as admin and unchecked too.
      We do not want to use /savecred because of security risk. What other steps can we take to find a solution.
      

Window 10 and on a domain