Windows 2012 R2 Password Reset Print

It is extremely important that you reset the Administrator password AND replace the sethc.exe after completing the swap. Otherwise, someone with IPMI access to the machine could gain Administrator access.

Here are the steps:

1. Over IPMI, mount a Windows Server 2102 R2 installation disk (this can be found on Microsoft Technet Evaluation Center)
2. Reboot the server
3. Select Boot from CD/DVD media and start the Windows Server boot process
4. Select a language then Repair your computer -> Troubleshoot -> Command Prompt
5. Locate the Windows installation drive (C, D or others depending on installation type)
6. Copy the sethc.exe to a backup location
7. Replace sethc.exe with cmd.exe
8. Reboot the server
9. At the login screen, hit the SHIFT key five-TEN times (you can use the virtual keyboard for this)
10. Use the following command (replace <password> with a temporary password) to reset the Administrator password:
    net user Administrator <password>
11. Login using the temporary password
12. Reset the password from the Windows Server environment
13. Replace the sethc.exe with the backed-up version.

Key commands for steps 6 and 7 (the d:\ may be c:\ or something else based on your step 5 determination):

copy d:\windows\system32\sethc.exe d:\windows\system32\sethc-old.exe
copy d:\windows\system32\cmd.exe d:\windows\system32\sethc.exe

Key commands for step 13:

copy c:\windows\system32\sethc-old.exe c:\windows\system32\sethc.exe

This is all you need to get back into a Windows Server 2012 R2 system you have IPMI access to.

Final Words

Even if you never have to recover a lost Windows Server Administrator password using this methodology, it should be eye-opening. Modern servers do include iKVM functionality with the ability to remotely mount ISO images. This entire operation can occur over a period of a few minutes and leaves the system vulnerable if the sethc.exe is not replaced. Our suggestion is to use a separate network or vlan for all IPMI interfaces.