Reset Windows 10/11 Password Without USB or Reinstall

[Sascha]

Hi there, Its jack, i got locked of my machine 10 minutes before posting this, i thought maybe this post might help some folks out :)

TL;DR (2 minutes)

1. Boot into Windows Recovery Environment (WinRE).
2. Swap utilman.exe with cmd.exe on *C:*.
3. On the login screen, hit Ease of Access → instant SYSTEM cmd.
4. Run: net user "YourUser" NewPass123!.
5. Log in, then restore utilman.exe to close the backdoor.

Done. No USB sticks, no reinstall.

Copy/Paste Cheat Sheet


:: WinRE Command Prompt (assumes Windows on C:)
bcdedit | find "osdevice" :: optional sanity check
copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.bak
copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
exit :: reboot

:: Login screen → Ease of Access shell
net user :: list users
net user "YourUser" NewPass123!
exit

:: After logging in (Admin cmd)
copy C:\Windows\System32\utilman.bak C:\Windows\System32\utilman.exe



Why This Works (30 seconds)


utilman.exe (Ease of Access) runs before you sign in. Replace it with cmd.exe, click the icon on the login screen, and you get a SYSTEM shell. SYSTEM can change local passwords. Afterwards, put utilman.exe back. Boom.

BitLocker alert: If the drive is locked with BitLocker, you’ll need the recovery key before you can touch C:\Windows\System32.

Step 0: Force Windows Into WinRE


Can’t log in? Crash it into recovery:

1. Power on.
2. When you see spinning dots, hold power to force shutdown.
3. Do it twice. On the third boot: Preparing Automatic Repair → Advanced options.

Then: Troubleshoot → Advanced options → Command Prompt.

You’ll land at something like:


X:\Sources>



Step 1 (Optional): Verify Windows Drive Letter


It’s usually C:. If you want to be sure:


bcdedit | find "osdevice"




Sample output:


osdevice partition=C:




If it says C:, keep following as-is. If not, swap the letter in the commands below.

Step 2: Backup utilman.exe & Drop In cmd.exe


Commands (assuming Windows is on C:):


copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.bak
copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe




Overwrite prompt? Type .

Type exit and reboot.

Step 3: Pop a SYSTEM Shell From the Login Screen


At the login screen, click the Ease of Access icon (bottom-right). Instead of accessibility tools, you get Command Prompt as SYSTEM.

List users so you don’t guess wrong:


net user




Reset the password (exact username, wrap in quotes if it has spaces, e.g. Jack):


net user Jack MyNewPassword




You should see: The command completed successfully.

Close the window, log in with the new password.

Step 4: Restore utilman.exe (Don’t Leave a Door Open)


This step is optional, since it doesn't mess up your system, but security wise, its recommended to do.

Inside Windows, open Command Prompt as Administrator:


copy C:\Windows\System32\utilman.bak C:\Windows\System32\utilman.exe




Y to overwrite.

That closes the backdoor — the Ease of Access button works normally again.

Troubleshooting & Gotchas


“Access is denied” / Error 5

You didn’t get a SYSTEM shell. Make sure you clicked Ease of Access after the swap.

Username typos

Run net user first. Match the exact name, or wrap it in quotes.

Messed up the wrong file / forgot to restore

Boot back to WinRE and reverse it:


copy C:\Windows\System32\utilman.bak C:\Windows\System32\utilman.exe




BitLocker prompt

No key, no access. Period.

Microsoft or Domain accounts

Final Notes

• This is a break-glass move, not routine hygiene. Use a password manager, link a recovery email/phone, or create a reset disk so you don’t need this again.
• If this saved you time/money/your sanity, drop a thanks — and document your own “oh crap” fixes for Future You.

Hope i could help you :)

Happy un-locking

Источник:

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.