Here’s how to gain admin-level access, using a Windows-recovery disc or drive. I used Win10, but Win7/8 are similar.
- Boot the PC with the Windows Recovery disc/drive and enter the Recovery Environment. (For detailed, step-by-step info, see the June 23 Top Story, “Using Windows’ powerful Recovery Environment.”)
- The Recovery Environment typically temporarily changes the drive letters of a PC, so explore the PC to find what used to be its C: drive. (The aforementioned Top Story has instructions.)
- Navigate to the system’s original \Windows\System32 folder — for example, if the Recovery Environment has temporarily labeled the original C: drive as E:, you’ll go to E:\Windows\System32/ (I use E: in the following steps.)
- Type in ren sethc.exe sethc.bak to rename the Sticky Keys app. (You’ll restore this renamed file later, when you restore the PC to its original configuration.)
- Still in E:\Windows\System32, enter copy cmd.exe sethc.exe to create a copy of the standard command-window app (cmd.exe) with the name sethc.exe (See Figure 1).
- Enter Exit to leave the command portion of the Recovery Environment.
- Reboot or select Exit and continue to Windows 10 to restart the system.
- Back at the Windows sign-in screen, press the Shift key five times in rapid succession, which normally launches Sticky Keys. This time, however, a command window will open (because sethc.exe is a renamed copy of cmd.exe). You’ll now be inside the system’s \Windows\System32 folder (Figure 2) and signed in as System — the highest-possible privilege level. You now have complete control over everything.
- Command-line environments can be awkward to use. Entering the
following commands will create a new, full-featured, administrator
account you can use with a standard Windows screen: net user tempadmin /add net localgroup administrators tempadmin /add net user tempadmin 123456
The above commands create a new temporary administrator account with the username tempadmin and the password 123456 (see Figure 3). You’re free to substitute any username and (more secure) password you wish. Figure 3. These commands create an unrestricted admin-level account with your choice of username/password (tempadmin/123456, in this example).
- Reboot the system.
- When Windows starts there’ll be a new account — in this case, called tempadmin — on the sign-in page (see Figure 4). It’s an utterly standard, full-featured, unrestricted administrator-level account that will let you do anything allowed in such accounts.
- Select the new account and sign in with the password you created. Let Windows finish setting up the new account and then carry out your repair/recovery/restoration activity.
When you’re done, clean up. Delete the bogus sethc.exe file you created and rename sethc.bak to sethc.exe — you might also wish to delete the admin account you just created.