Changing lost Admin Passphrase on Windows 7 Bitlocker encrypted drives

I don’t know what happened, but a customer of mine forgot the Admin account passphrase. Maybe forgot was not the right way to put it, as the one it should have been did not work anymore. My best guess was my customer changed it himself and couldn’t remember. But saying that out loud would be treason so I just kept my mouth shut and was looking for a way to reset the passphrase. Something that turned out to be a nightmare as my customer did not make a recovery cd.

First try – WinPE

My first try was looking at Serverfault . I will spare you the details. It did not work. manage-bde.wsf seems to have been replaced by manage-bde.exe and it’s documentation on Microsoft’s side is just wrong. After figuring out how to use this tool correctly it did not work. Output: invalid key. So there I have the one bitlocker key for the computer on one usb stick. Booting the computer with it works so it has to be the right key. “Try using the recovery key” you’d say? Wrong! Invalid key!

Solution – Windows registry

So here is the solution. You need:

• Another Windows 7 computer (I am using Win7 Professional) with the HD of the windows machine we need to reset the passphrase of (called affected hd in the future)

Change Registry

• Download PSTools
• Open cmd as Administrator and start regedit with System Account Security Context: Psexec.exe –s –i regedit.exe
• Browse to HKLM
• Click on File -> Open Hive
• Select SAM: <affected hd>\%windir%\system32\config\SAM
• Select: Name of Hive -> SAM -> Domains -> Account -> User -> Names -> Administrator
• Look at the value of the single entry and navigate to the appropriate registry Key with the same value in the parent directory
• Edit the F Key
• On position 0038 change “11” to “10”
• Double check for errors before clicking OK
• Shutdown, remove HD and insert it into the computer it belongs to

Change your account’s passwords

• Boot computer
• You see a new user called “Administrator”. Click it
• Logging in takes place
• Open Userpreferences and change your user’s passphrase
• Logout
• Login with your normal admin user to test if everything worked fine
• If it did, disable Administrator again

Disable Administrator account

• Open “lusrmgr.msc”
• Double click on Users -> Administrator
• Check “Disable Account”
• Reboot
• Check if Administrator Account is still visible
• It isn’t? Great, you are done
• It is? You did a mistake. Check all steps for possible errors.

Conclusion

These steps take only 30 minutes to accomplish. It’s easy to do. What’s difficult is finding the right path. Documentation tends to be very bad on closed source products. Especially Microsoft’s documentation available online is really really bad. If there is something Microsoft should learn from companies like Red Hat it’s how to write helpful documentation and bring it online. I really don’t care about two hundred ways to get pricey licenses for being an official Microsoft representative. I need good online documentation to avoid using bad documented tools not suitable for the job.