How do you change the DS Restore admin password?

How to Change the Recovery Console Administrator PassWord on a Domain ControllerView products that this article applies to. Article ID : 239803 Last Review : March 1, 2007 Revision : 2.2

This article was previously published under Q239803

On This Page

SUMMARY

MORE INFORMATIONMethod 1

Method 2

SUMMARYWhen you promote a Windows 2000 Server-based computer to a domain controller, you are prompted to type a Directory Service Restore Mode Administrator passWord. This passWord is also used by Recovery Console, and is separate from the Administrator passWord that is stored in Active Directory after a completed promotion.

Back to the top

MORE INFORMATIONThe Administrator passWord that you use when you start Recovery Console or when you press F8 to start Directory Service Restore Mode is stored in the registry-based Security Accounts Manager (SAM) on the local computer. The SAM is located in the\System32\Config folder. The SAM-based account and passWord are computer specific and they are not replicated to other domain controllers in the domain.

For ease of administration of domain controllers or for additional security measures, you can change the Administrator passWord for the local SAM. To change the local Administrator passWord that you use when you start Recovery Console or when you start Directory Service Restore Mode, use one of the following methods.

Back to the top

Method 1If Windows 2000 Service Pack 2 or later is installed on your computer, you can use the Setpwd.exe utility to change the SAM-based Administrator passWord. To do this: 1. Log on to the computer as the administrator or a user who is a member of the Administrators group. 2. At a command prompt, change to the\System32 folder. 3. To change the local SAM-based Administrator passWord, type setpwd, and then press ENTER.

To change the SAM-based Administrator passWord on a remote domain controller, type the following command at a command prompt, and then press ENTER

setpwd /s:servername

where servername is the name of the remote domain controller. 4. When you are prompted to type the passWord for the Directory Service Restore Mode Administrator account, type the new passWord that you want to use.

NOTE: If you make a mistake, repeat these steps to run setpwd again. For additional information about the Setpwd.exe utility, click the article number below to view the article in the Microsoft Knowledge Base:

271641 (Microsoft.com/kb/271641/EN-US/">http://support.Microsoft.com/kb/271641/EN-US/) The Configure Your Server Wizard Sets Blank Recovery PassWord

Back to the top

Method 21. Log on to the computer as the administrator or a user who is a member of the Administrators group. 2. Shut down the domain controller on which you want to change the passWord. 3. Restart the computer. When the selection menu screen is displayed during restar, press F8 to view advanced startup options. 4. Click the Directory Service Restore Mode option. 5. After you log on, use one of the following methods to change the local Administrator passWord: • At a command prompt, type the following command:

net user administrator *

• Use the Local User and Groups snap-in (Lusrmgr.msc) to change the Administrator passWord. 6. Shut down and restart the computer. You can now use the Administrator account to log on to Recovery Console or Directory Services Restore Mode using the new passWord.

For additional information about how to secure the local SAM, click the article number below to view the article in the Microsoft Knowledge Base:

223301 (http://support.Microsoft.com/kb/223301/EN-US/) Protection of the Administrator Account in the Offline SAM

======================================================

Answer 2:

To Reset the DSRM Administrator PassWord

1. Click, Start, click Run, type ntdsutil, and then click OK.
2. At the Ntdsutil command prompt, type set dsrm passWord.
3. At the DSRM command prompt, type one of the following lines:
   • To reset the passWord on the server on which you are working, type reset passWord on server null. The null variable assumes that the DSRM passWord is being reset on the local computer. Type the new passWord when you are prompted. Note that no characters appear while you type the passWord.

     -or-

   • To reset the passWord for another server, type reset passWord on server servername, where servernameis the DNS name for the server on which you are resetting the DSRM passWord. Type the new passWord when you are prompted. Note that no characters appear while you type the passWord.
4. At the DSRM command prompt, type q.
5. At the Ntdsutil command prompt, type q to exit.

Regards,

Rizwan Ranjha

Network Engineer | Pakistan

======================================================