chntpw: Resetting Windows Passwords From a Linux Live Environment

I still remember the first time I used chntpw. A friend had locked himself out of an old Windows 7 laptop after a botched update, and instead of nuking the whole drive and starting fresh, I booted a Linux live USB, ran one small tool against the SAM registry hive, and had him back into his account in under ten minutes. That tool was chntpw, and it’s been part of my forensics and recovery toolkit ever since.

What Is chntpw?

chntpw (short for “change NT password”) is a small, offline utility for Linux that edits the Windows registry directly. It’s mainly known for blanking or resetting local account passwords, but it can do a lot more: enable disabled accounts, promote a user to administrator, and even browse and edit arbitrary registry keys. It works entirely offline — you’re not logged into Windows at all. Instead, you boot into a Linux environment, mount the Windows partition, and point chntpw at the SAM hive file directly.

This offline approach is exactly why it matters in both legitimate system recovery and authorized penetration testing / incident response work. If an attacker (or a pentester simulating one) gets physical access to a machine, or boot access via a live USB, Windows’ login screen is not a real barrier — the SAM database is just a file, and chntpw can edit it.

How It Works Internally

Windows stores local account information, including hashed passwords, in the SAM (Security Account Manager) registry hive, located at C:\Windows\System32\config\SAM. This file is locked while Windows is running, but if you boot from a different OS, the file is just sitting there on disk, unlocked and readable.

chntpw parses the raw NTFS/registry hive format itself — it doesn’t rely on the Windows API at all. It locates the user account records inside the SAM hive, then does one of the following depending on what you ask it to do:

• Blank the password — clears the stored password hash so Windows treats the account as having no password.
• Set a new hash — write a new NTLM hash directly (harder, rarely used interactively).
• Flip account control flags — for example, clearing the “account disabled” bit or setting the “never expires” bit.
• Add a user to the local Administrators group — by editing the SAM’s group membership structures.

Because it edits raw hive structures, chntpw also ships with a generic hive editor mode, letting you browse any registry hive (SYSTEM, SOFTWARE, NTUSER.DAT, etc.) and change arbitrary values — useful in forensics when you need to alter or inspect registry keys without booting the target OS.

Installation

On Debian/Ubuntu-based distros (including Kali Linux, where it’s preinstalled):

sudo apt update
sudo apt install chntpw -y

On Arch Linux:

sudo pacman -S chntpw

Verify it installed correctly:

chntpw

Running it with no arguments prints the version banner and usage help, confirming it’s ready to go.

Basic Syntax

chntpw [options] <SAM_file_path>

Common options:

Step-by-Step Usage (Lab Example)

This walkthrough assumes a Windows VM you own, in a lab environment, with a spare/test drive — never do this against a system you don’t have explicit authorization to modify.

1. Boot a Linux live environment (Kali Linux, SystemRescue, or any live USB with chntpw installed).

2. Identify and mount the Windows partition:

sudo fdisk -l
sudo mkdir /mnt/win
sudo mount /dev/sda2 /mnt/win

3. List the local users on the SAM hive:

cd /mnt/win/Windows/System32/config
sudo chntpw -l SAM

Sample output:

* SAM policy limits:
Failed logins before lockout is 0
Minimum password length        : 0
Password history count         : 0
| RID -|---------- Username ------------| Admin? |- Lock? --|
| 01f4 | Administrator                   | ADMIN  |          |
| 03e9 | JohnDoe                         |        | dis/lock |
| 03ea | Guest                           |        | dis/lock |

4. Select the target user and clear the password:

sudo chntpw -u JohnDoe SAM

You’ll land in an interactive menu:

1 - Edit user data and passwords
2 - List groups
q - Quit

Select: [1] 1

RID     : 1001 [03e9]
Username: JohnDoe
...
* = blank the password (This may work better than setting a new password!)
- = disable the user account
* etc: enter the letter left of the question below to change it

Select: * blank the password
Password cleared!

5. Write the changes back to disk:

Select: (q)uit and write back? y

Unmount and reboot into Windows — the account now logs in with no password.

Real-World Use Cases

• Digital forensics: Investigators use chntpw to access locked systems as part of a documented, warrant-authorized investigation, or to inspect registry artifacts without powering on the original OS (which would alter timestamps and evidence).
• Penetration testing: In a physical security or “evil maid” style engagement (with signed authorization), demonstrating that local account controls don’t protect against boot-level access is a core finding for many security assessments.
• Incident response: If a compromised machine has an admin account locked out or disabled by an attacker, IR teams can use chntpw offline to restore access without waiting on Windows recovery mechanisms.
• Legitimate recovery: The most common use by far — home users or IT admins who’ve simply forgotten a local password.

Integration With Other Tools

chntpw is often paired with:

• Live boot toolkits like Kali Linux or SystemRescue, which provide the Linux environment to run it from.
• mimikatz or secretsdump.py (from Impacket) for extracting hashes once access is regained, in authorized credential-auditing work.
• Autopsy/Sleuth Kit in forensic workflows, where chntpw’s raw hive access complements broader disk forensics.

Troubleshooting & Common Mistakes

• “Can’t open file, not a registry” errors: usually means you pointed chntpw at the wrong file or a corrupted hive — double check you’re inside Windows/System32/config and targeting SAM, not SYSTEM or SOFTWARE.
• BitLocker-encrypted drives: chntpw cannot help here — you must unlock BitLocker first (with the recovery key) before the partition is even readable.
• Changes not persisting: Forgetting to confirm “write hive files” (y) at the final prompt is the single most common mistake — always confirm the write step.
• Windows Hello / Microsoft account logins: chntpw only affects local SAM accounts. If the machine uses a Microsoft account for sign-in, blanking the local password won’t unlock a Microsoft-account-bound login screen in the same way; you may need to force a local account fallback first.

Best Practices

• Always work on a copy of the disk image in forensic contexts to preserve the original evidence.
• Get written authorization before touching any system you don’t personally own — this is legally sensitive territory.
• Combine with -e hive editor mode carefully; manual edits to arbitrary registry values can break Windows if done incorrectly.

FAQ

Does chntpw work on Windows 10/11? Yes, the SAM hive format hasn’t fundamentally changed, though newer builds sometimes use Windows Hello PIN/biometric logins layered on top, which chntpw doesn’t directly touch.

Is chntpw detected by antivirus? Since it runs from a separate boot environment, there’s no running Windows AV to detect it. It’s the offline access itself that’s the “detection gap.”

Can I use chntpw to crack a password instead of resetting it? No — it doesn’t crack hashes; it clears or overwrites them. For hash cracking, tools like John the Ripper or Hashcat are the right choice.

Summary

chntpw is a small but powerful reminder that local Windows authentication is only as strong as physical/boot-level access controls. Whether you’re recovering your own forgotten password, performing an authorized penetration test, or conducting digital forensics, it gets the job done from outside the OS entirely. Used responsibly and only on systems you’re authorized to access, it remains one of the most reliable tools for offline Windows account recovery.

References

• Official project page: https://pogostick.net/~pnh/ntpasswd/
• Source repository (GitHub mirror): https://github.com/tortoiselabs/chntpw
• Man page: man chntpw (after installation)