Admin password won't work after restore point

[Guest]

I restored my laptop to a recovery point prior to when I connected it to our
SBS 2003 network, in an effort to recover files that were encryted with EFS.

I was not connected to the network when the SBS 2003 software requested I
change my password. It accepted the new password, but I was unable to access
any documents that were encrypted with EFS. I tried to take ownership of
these while logged on as a administrator, but nothing seemed to work.

In an effort to recover them, I though if I restored my laptop to a point
prior to connecting it to the network, I would be ok. It would have my old
password, and the files should decrypt ok. The restore point "help" also
noted that new files would be kept intact, so it seemed like the perfect
solution.

The restore went ok, but now it doesn't like the password for the admin
account. A 2nd user account works, but the admin account does not.

Without doing a full restore (which I have, but is several weeks old), is
there anyway to reset my admin password if I'm logged on as a user?

I fear the full system restore, in addition to losing my last few weeks of
work, will leave me in the same boat. It will restore the files, but ask me
for the password. The hint I coded in isn't helping me.

Any thoughts, old DOS commands, anything to reset it would be appreciated.

Bob

 

[Steven L Umbach]

I have never tried to use System Restore on a domain computer to a point
where the computer was not joined to the domain to know exactly what
happened. You need to logon as the same user that encrypted those files
whether the user was a local user account or a domain user even if they have
the same user name. The EFS private key that can decrypt the EFS files is
stored in your user profile. If you "reset" your user password on a local
user account instead of changing it via Control-Alt-Delete or when prompted
by the operating system the new password will not work to decrypt the files
though if you change it back to the password that did work then access
"should" be restored. There are ways to reset the built in administrator
account but if the computer is still joined to the domain a domain
administrator should be able to do that and I would not try such a utility
anyhow without checking with them. I would ask your admin or support for
help on what to do. There may have been an EFS Recovery Agent designated for
the domain computers that could recover your files. EFS is something that
should not be used unless the user knows about is risks and how to avoid
them but unfortunately most do not learn about it until a problem
ises. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;223316 --- EFS
best practices.

 

[Guest]

Thanks Steve.

Turns out I never got around to creating that "private key" with the floppy.
I was un-encrypting files prior to my backups, but my last backup is a few
weeks old, so I lost some work.

EFS is a bit trickier than it looks. I just wish you would get a promt or
warning message before these things occur.

I ended up booting the laptop in safe mode and resetting the admin password.
Like I said, lucky I had a backup that was not encrypted, just wish it would
of been more recent.

Thanks for your help. I learn something new everyday.

 

[Steven L Umbach]

Thanks for reporting back. Though you may not feel like it right now
consider yourself lucky as many many users have posted here and other forums
how they had years of data that was in EFS encrypted files and they had no
clear text backups or backup of their EFS private key to a password
protected .pfx file on external media for safekeeping. Congrats to you for
keeping backups even if they are not as current as you want. If you want to
try it there is a third party program from Elcomsoft that you can try by
downloading the demo that will search your computer for your EFS private key
and if you plug in the correct password for it you can recovery your EFS
files. The demo version will only recover small portion files but if it
works it may be worth the $100 for you to download the full version. The
link below has more details. --- Steve

http://www.elcomsoft.com/aefsdr.html --- Elcomsoft EFS recovery

 

[coal_brona]

Well,

If the pass is wrong you can reset it using special tools such as
Active@ Password Changer. The small utility can easily perform the
operation, it is small and easy to use, yet really powerful. Give it a
chance,that should help.

http://www.password-changer.com/