How to reset windows password (offline) on AWS Windows Instance

In simple word changing/resetting windows password is a very simple task using any third party free or paid tools as long as you able to access server console. Even on virtual platform like Hyper-V VMWare you have access to server console, but when it comes to AWS, there is no way to access console of a virtual instances. So, those tools will not work, as those required user input / virtual CD or USB boot, which is not available in AWS.

I have found a solution to reset the password of any AWS windows instance. If you know the local user id, then it will be very easy to reset the password of that account.

You have to perform the following steps.

  • First you have to stop the instance.
  • Then you have to identify the root volume (/dev/sda1) of that instance. You could get this information using one simple function I wrote (GetInstanceVolumeDetails InstanceID).
  • Once you identified the root volume, Took a snapshot backup of root volume.
  • Now you have to dismount this volume and remount it on any other working instance as additional volume.

  • This volume mounted as G: drive on working instance. Now you have to create one service using srvany.exe ( to rest the password of Administrator account during system startup. To configure this you have to load up the system registry hive of faulty instance from G:\Windows\System32\Config\SYSTEM as _SYS under HKEY_LOCAL_MACHINE and import the following registry

  • Now placed srvany.exe under G: drive.

  • If the operating system is later than Windows Server 2003, you have to complete the following steps or you won’t be able to boot the instance after changes in its root volume because of a disk signature collision.
  • In the Registry Editor, load the following registry hive into a folder named BCD: F:bootbcd.
  • Search for the following data value in BCD: “Windows Boot Manager”. You’ll find a match under a key named 12000004.
  • Select the key named 11000001 that is sibling to the key you found in the previous step. View the data for the Element value.
  • Locate the four-byte disk signature at offset 0x38 in the data. Reverse the bytes to create the disk signature, and write it down. For example, the disk signature represented by the following data is E9EB3AA5:

    0030 00 00 00 00 01 00 00 00
    0038 A5 3A EB E9 00 00 00 00
    0040 00 00 00 00 00 00 00 00

  • In a Command Prompt window, run the following command to start Microsoft DiskPart.

    C:> diskpart

  • Run the following DiskPart command to select the volume. (You can verify that the disk number is 1 using the Disk Management utility.)

    DISKPART> select disk 1
    Disk 1 is now the selected disk.

  • Run the following DiskPart command to get the disk signature.

    DISKPART> uniqueid disk
    Disk ID: 0C764FA8

  • If the disk signature shown in the previous step doesn’t match the disk signature from BCD that you wrote down earlier, use the following DiskPart command to change the disk signature so that it matches:

    DISKPART> uniqueid disk id=E9EB3AA5

  • Once server booted up, you will able to logon to the server using new password.
  • Re-joined the server to the domain and remove the service from registry.
  • Remove the imported registry from using following command from command prompt.

    REG DELETE HKLMControlSet001ServicesPwdReset

Disclaimer: All posts and opinions on this site are provided AS IS with no warranties. These are our own personal opinions and do not represent our employer’s view in any way.

This article currently have 8,464 views

Follow me

CC BY-ND 4.0 This work is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License.

One comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.