EC2 Windows password recover | Techno Chat|Tech Blog!!

As mentioned earlier, we could reset the local admin password of windows instances via registry, but unfortunately that will not going to help us if we forget the user id details or we renamed the user id. And the good news is, we still will be able to logon into the system by creating one new Admin Account using AWS User Data. This process is very simple as described bellow.

You have to re-attached the root volume of faulty system to a working AWS instances.
Now, you have to use EC2Rescue to enable user data (Ec2HandelUserData), which will execute a script on next boot. (*This could be done by editing config.xml file of EC2Config)

Once done, you have to re-attach the volume to the original system as root (/dev/sda1) volume.
Now, from AWS EC2 Console, you have to select the server and edit the User Data before starting the server and add the following PowerShell script. This script will create a Admin Account called “MyAdminX” with the password “!!4SJKAHGYWMd4!!” on first boot and you will be able to logon to the server using this new account.

<powershell>
$Name="MyAdminX"
$Computer = [ADSI]"WinNT://$Env:COMPUTERNAME,Computer"
$LocalAdmin = $Computer.Create("User", $Name)
$LocalAdmin.SetPassword("!!4SJKAHGYWMd4!!")
$LocalAdmin.SetInfo()
$LocalAdmin.FullName = $Name
$LocalAdmin.SetInfo()
$LocalAdmin.Description = "Admin Account created using User Data"
$LocalAdmin.SetInfo()
$LocalAdmin.UserFlags = 64 + 65536 # ADS_UF_PASSWD_CANT_CHANGE + ADS_UF_DONT_EXPIRE_PASSWD
$LocalAdmin.SetInfo()
$AdminGroup = [ADSI]"WinNT://$Env:COMPUTERNAME/Administrators,group"
$User = [ADSI]"WinNT://$Env:COMPUTERNAME/$Name,User"
$AdminGroup.Add($User.Path)
</powershell>

$Name="MyAdminX"

$Computer = [ADSI]"WinNT://$Env:COMPUTERNAME,Computer"

$LocalAdmin = $Computer.Create("User", $Name)

$LocalAdmin.SetPassword("!!4SJKAHGYWMd4!!")

$LocalAdmin.SetInfo()

$LocalAdmin.FullName = $Name

$LocalAdmin.SetInfo()

$LocalAdmin.Description = "Admin Account created using User Data"

$LocalAdmin.SetInfo()

$LocalAdmin.UserFlags = 64 + 65536 # ADS_UF_PASSWD_CANT_CHANGE + ADS_UF_DONT_EXPIRE_PASSWD

$LocalAdmin.SetInfo()

$AdminGroup = [ADSI]"WinNT://$Env:COMPUTERNAME/Administrators,group"

$User = [ADSI]"WinNT://$Env:COMPUTERNAME/$Name,User"

$AdminGroup.Add($User.Path)

</powershell>

I hope this will be helpful for you.

In simple word changing/resetting windows password is a very simple task using any third party free or paid tools as long as you able to access server console. Even on virtual platform like Hyper-V VMWare you have access to server console, but when it comes to AWS, there is no way to access console of a virtual instances. So, those tools will not work, as those required user input / virtual CD or USB boot, which is not available in AWS.

I have found a solution to reset the password of any AWS windows instance. If you know the local user id, then it will be very easy to reset the password of that account.

You have to perform the following steps.

First you have to stop the instance.

Then you have to identify the root volume (/dev/sda1) of that instance. You could get this information using one simple function I wrote (GetInstanceVolumeDetails InstanceID).

function GetInstanceVolumeDetails ([string] $fInstanceID)
{
    $VolumeList = ((Get-EC2Volume).Attachment | where {$_.InstanceId -eq $fInstanceID}).VolumeId
    $VolumeDetails = @()
    foreach ($Volume in $VolumeList)
    {
            $MyObject = New-Object PSObject -Property @{
            VolumeId = $Volume
            VolumeSize = (Get-EC2Volume $Volume).Size
            Zone = (Get-EC2Volume $Volume).AvailabilityZone
            VolumeDevice = ((Get-EC2Volume $Volume).Attachment).Device
            }
        $VolumeDetails += $MyObject
    }
    $VolumeDetails | Select VolumeId,VolumeDevice,VolumeSize,Zone
}

function GetInstanceVolumeDetails ([string] $fInstanceID)

{

$VolumeList = ((Get-EC2Volume).Attachment | where {$_.InstanceId -eq $fInstanceID}).VolumeId

$VolumeDetails = @()

foreach ($Volume in $VolumeList)

{

$MyObject = New-Object PSObject -Property @{

VolumeId = $Volume

VolumeSize = (Get-EC2Volume $Volume).Size

Zone = (Get-EC2Volume $Volume).AvailabilityZone

VolumeDevice = ((Get-EC2Volume $Volume).Attachment).Device

}

$VolumeDetails += $MyObject

}

$VolumeDetails | Select VolumeId,VolumeDevice,VolumeSize,Zone

}

Once you identified the root volume, Took a snapshot backup of root volume.
Now you have to dismount this volume and remount it on any other working instance as additional volume.

This volume mounted as G: drive on working instance. Now you have to create one service using srvany.exe (http://support.microsoft.com/kb/137890) to rest the password of Administrator account during system startup. To configure this you have to load up the system registry hive of faulty instance from G:\Windows\System32\Config\SYSTEM as _SYS under HKEY_LOCAL_MACHINE and import the following registry

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE_SYSControlSet001ServicesPwdReset]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"DisplayName"="PwdReset"
"ObjectName"="LocalSystem"
"ImagePath"="c:\\srvany.exe"

[HKEY_LOCAL_MACHINE_SYSControlSet001ServicesPwdResetParameters]
"Application"="c:\\windows\\system32\\cmd.exe"
"AppParameters"="/k net user Administrator Password"