This afternoon (well, yesterday, actually, as it's now past mid-night
here), I booted my Win7 installation on this Laptop, updated my
Anti-Virus (AVG) and set it running and then walked away for several hours.

When I returned, the Laptop had closed down (Sleep mode, I think) and
wanted my Password before starting up again ..... and, of course, when I
entered what I thought the Password was, it was rejected .... so I must
have changed to password some time ago.

So where would my password be stored on my WINDOWS 7 system .... so that
I can boot up my Linux installation and, hopefully, look into the Win-7
installation to find out what my Password is??

Thanks.
--
Daniel

Daniel65 wrote:
> This afternoon (well, yesterday, actually, as it's now past mid-night
> here), I booted my Win7 installation on this Laptop, updated my
> Anti-Virus (AVG) and set it running and then walked away for several hours.
>
> When I returned, the Laptop had closed down (Sleep mode, I think) and
> wanted my Password before starting up again ..... and, of course, when I
> entered what I thought the Password was, it was rejected .... so I must
> have changed to password some time ago.
>
> So where would my password be stored on my WINDOWS 7 system .... so that
> I can boot up my Linux installation and, hopefully, look into the Win-7
> installation to find out what my Password is??
>
> Thanks.

Somebody with a stolen laptop would be in the same situation.
That's why we're reluctant to give info here.

Ed

Daniel65 wrote:

> This afternoon (well, yesterday, actually, as it's now past mid-night
> here), I booted my Win7 installation on this Laptop, updated my
> Anti-Virus (AVG) and set it running and then walked away for several hours.
>
> When I returned, the Laptop had closed down (Sleep mode, I think) and
> wanted my Password before starting up again ..... and, of course, when I
> entered what I thought the Password was, it was rejected .... so I must
> have changed to password some time ago.
>
> So where would my password be stored on my WINDOWS 7 system .... so that
> I can boot up my Linux installation and, hopefully, look into the Win-7
> installation to find out what my Password is??

It's not stored in any form that is easily recoverable. It can be reset using
a special-purpose Linux distro called ntpasswd:

http://pogostick.net/~pnh/ntpasswd/

....but note that if you have an encrypted filesystem, all encrypted files
will be lost, ***PERMANENTLY***. If you don't have encrypted files, then in
general, no worries, go ahead and do it. I've used this tool many times
without issue. HOWEVER! I have never used it on a machine that was not
properly shut down. If that's your situation, you're on your own.

--
Actions speak louder than protest signs.

On Jun 14, 2023, Daniel65 wrote
(in article <u6cjuj$1v7g$1@dont-email.me>):

> This afternoon (well, yesterday, actually, as it's now past mid-night
> here), I booted my Win7 installation on this Laptop, updated my
> Anti-Virus (AVG) and set it running and then walked away for several hours.
>
> When I returned, the Laptop had closed down (Sleep mode, I think) and
> wanted my Password before starting up again ..... and, of course, when I
> entered what I thought the Password was, it was rejected .... so I must
> have changed to password some time ago.
>
> So where would my password be stored on my WINDOWS 7 system .... so that
> I can boot up my Linux installation and, hopefully, look into the Win-7
> installation to find out what my Password is??
>
> Thanks.

That depends. Local (that is, not Active Directory) passwords are stored in
SAM settings, and can easily be reset with any of several password
crackers... if you have physical access. Warning: if encryption is turned on,
all files on the system will be PERMANENTLY lost. Gone. Bye-bye. Active
Diretory passwords may be cached in various ways and will be stored on the
ADDS server. See
https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-
t echnical-overview

On 6/14/2023 10:47 AM, Daniel65 wrote:
> This afternoon (well, yesterday, actually, as it's now past mid-night here), I booted my Win7 installation on this Laptop, updated my Anti-Virus (AVG) and set it running and then walked away for several hours.
>
> When I returned, the Laptop had closed down (Sleep mode, I think) and wanted my Password before starting up again ..... and, of course, when I entered what I thought the Password was, it was rejected .... so I must have changed to password some time ago.
>
> So where would my password be stored on my WINDOWS 7 system .... so that I can boot up my Linux installation and, hopefully, look into the Win-7 installation to find out what my Password is??
>
> Thanks.

You're lucky it isn't an MSA-style password. Local password
storage is a bit easier to deal with.

There is cracking (Kali plus a video card),
and flattening (zero out password). Since this is your
personal machine, flattening it a LOT less work and time.

I would be more curious about what has happened
to the poor machine. Is the account perhaps disabled ?
There are more things you can do, besides change the
password.

Perhaps the password WAS accepted, but there was some
critical Profile (home directory) information missing.
And it just popped out of the profile because it could
not load the profile registry files.

If the Hiberfile is in usage, then Linux cannot mount
the C: file system. Sleep, by itself, is not hibernation
and so you should be able to get in from Linux. But
Hybrid Sleep uses the hiberfil.sys and now Linux will refuse.
And the NTFSfix utility won't fix that either as far as I know.

To back up the hard drive, in its current sorry state,
you can do a "dd" transfer and transfer off the entire
TB sized thing as "laptop.img" file. Then, if your attempts
to fix it, trash the drive, you can use "dd" again to restore
"laptop.img" over top. I say that, because it's quite possible
that Macrium Reflect will not back up a hibernated partition
either.

I would guess you're in for some fun, before you can figure
out whether you still have a Home Directory or not.

You can't flatten the password, until you can get into the
file system.

Potential steps:

1) Back up the hard drive with "dd", storing the result on
an external drive. You might have to remove the battery pack,
so that the chipset will "forget" it is in a hibernation state.
2) Remove battery pack. Use adapter along. Start laptop. Wait for password prompt
from Windows to appear. Unplug wall adapter (killing OS
with restore-from-hibernation completed by the boot process).
Hopefully, that will invalidate the hiberfil.sys header.
This assumes it isn't the laptop BIOS password you are seeing,
but something else like the Windows password prompt.
3) Now, plug the wall adapter back in, use the boot controls to
boot from a Linux LiveDVD. And start with the rest of the plan
(whatever your plan is).

I'm assuming it is hybrid sleep (and a hiberfil.sys issue). If
it is not, then there might be fewer steps involved to just
flattening the password.

But you really have to ask yourself, what the hell is going on,
because none of this is exactly normal behavior.

Paul

On Thu, 15 Jun 2023 00:47:44 +1000, Daniel65
<daniel47@nomail.afraid.org> wrote:

>So where would my password be stored on my WINDOWS 7 system .... so that
>I can boot up my Linux installation and, hopefully, look into the Win-7
>installation to find out what my Password is??

on Hiren's bootcd is a nice pprgram to view and change windows
passwords. I used it on a W10 sytem where the users didn't remember
his login password. After "cracking" the laptop I found out the
password was not locally stored ( microsoft account password ). The
person didn't pass the security questions on the recovery site from
M$. I got access to the locked laptop, but I/we couldn't recover his
W10 login password.
Luckely for you you have a standerd W7 password.

Daniel65 wrote on 15/06/2023 12:47 am:
> This afternoon (well, yesterday, actually, as it's now past mid-night
> here), I booted my Win7 installation on this Laptop, updated my
> Anti-Virus (AVG) and set it running and then walked away for several hours.
>
> When I returned, the Laptop had closed down (Sleep mode, I think) and
> wanted my Password before starting up again ..... and, of course, when I
> entered what I thought the Password was, it was rejected .... so I must
> have changed to password some time ago.
>
> So where would my password be stored on my WINDOWS 7 system .... so that
> I can boot up my Linux installation and, hopefully, look into the Win-7
> installation to find out what my Password is??
>
> Thanks.

On Friday evening, I realised that my panic might have been unnecessary
..... and tonight (Sunday), when I finally got arround to booting back
into my WIN7 installation, I got the screen telling me that my Win7 had
experienced an unusual close down and giving me the option of recovering
that session or to just do a "Normal" boot, ..... and here I am after
doing a "Normal" boot!! ;-)

I'll; check out the five responses (Thank you all very much.) to find
out how to recover my password. ;-)
--
Daniel

Auric__ wrote on 15/06/2023 3:52 am:
> Daniel65 wrote:
>
>> This afternoon (well, yesterday, actually, as it's now past
>> mid-night here), I booted my Win7 installation on this Laptop,
>> updated my Anti-Virus (AVG) and set it running and then walked away
>> for several hours.
>>
>> When I returned, the Laptop had closed down (Sleep mode, I think)
>> and wanted my Password before starting up again ..... and, of
>> course, when I entered what I thought the Password was, it was
>> rejected .... so I must have changed to password some time ago.
>>
>> So where would my password be stored on my WINDOWS 7 system .... so
>> that I can boot up my Linux installation and, hopefully, look into
>> the Win-7 installation to find out what my Password is??
>
> It's not stored in any form that is easily recoverable. It can be
> reset using a special-purpose Linux distro called ntpasswd:
>
> http://pogostick.net/~pnh/ntpasswd/
>
> ...but note that if you have an encrypted filesystem, all encrypted
> files will be lost, ***PERMANENTLY***. If you don't have encrypted
> files, then in general, no worries, go ahead and do it. I've used
> this tool many times without issue. HOWEVER! I have never used it on
> a machine that was not properly shut down. If that's your situation,
> you're on your own.
>
This is looking very hopeful for my obtaining the Password, Auric ....
you know, .... just in case I need it in the future. ;-)
--
Daniel