Sampasswd: Resetting and Listing Windows SAM Database Passwords in Kali Linux

Not every Windows password problem is about cracking a hash — sometimes the more practical need is resetting or listing accounts directly in the SAM database when a system is inaccessible offline, such as during forensic recovery or when a Windows machine is unbootable and needs local password recovery. That’s the exact job of Sampasswd, a small but focused utility bundled with the chntpw package in Kali Linux.

This article covers Sampasswd’s purpose, how it fits inside the chntpw toolset, installation, syntax, real command examples with output, and its role in offline Windows password recovery workflows.

What Is Sampasswd?

Sampasswd is a command-line utility, part of the chntpw (Change NT Password) suite written by Petter N. Hagen, used to reset a user’s password or list users directly within an offline Windows SAM (Security Account Manager) database file. Unlike hash-cracking tools such as Hashcat or John the Ripper, which try to recover the original plaintext password, Sampasswd takes a more direct approach: it overwrites the stored password hash in the SAM hive so a blank password (or a specific reset condition) can be used to log in — no need to know the original password at all.

It’s designed to be run against an offline copy of the SAM hive, typically after booting a target Windows machine from a Kali Linux live USB and mounting the Windows filesystem.

Architecture and Internal Working

1. SAM hive parsing: Sampasswd reads the binary structure of the Windows SAM registry hive, which stores each local user’s Relative Identifier (RID), account flags, and password hash data.
2. User lookup: Users can be referenced either by username or by their RID in hexadecimal form (e.g., 0x3ea), since accounts with international/non-ASCII usernames may not be found by name lookup alone.
3. Password field overwrite: Rather than decrypting the existing hash, Sampasswd overwrites the relevant password hash fields, effectively “resetting” the account’s password to blank, without needing the syskey or original password.
4. Listing mode: In list mode, Sampasswd walks the SAM’s user records and prints out account names, RIDs, and status flags without modifying anything — useful purely for reconnaissance before deciding which account to reset.

Because it’s bundled with chntpw, Sampasswd is designed to work alongside reged (registry editor) and samunlock (account unlock utility) as part of a broader offline Windows account-recovery toolkit.

Installation

Sampasswd is installed automatically as part of the chntpw package on Kali Linux:

sudo apt update
sudo apt install chntpw -y

Verify installation:

sampasswd -h

Expected output:

sampasswd version 0.2 140201, (c) Petter N Hagen
sampasswd [-r|-l] [-H] -u <user> <samhive>
Reset password or list users in SAM database

Mode:
 -r = reset users password
 -l = list users in sam
Parameters:
 <user> can be given as a username or a RID in hex with 0x in front
Example:
 -r -u theboss    -> resets password of user named 'theboss' if found
 -r -u 0x3ea       -> resets password for user with RID 0x3ea (hex)
 -r -a             -> Reset password of all users in administrators group (0x220)
 -r -f             -> Reset password of admin user with lowest RID

Basic Syntax

sampasswd [-r|-l] [-H] -u <user> <samhive>

Key flags:

• -r : reset mode — resets the specified user’s password
• -l : list mode — lists all users found in the SAM hive
• -u <user> : target username or RID (hex, prefixed with 0x)
• -a : reset passwords of all users in the administrators group
• -f : reset password of the admin user with the lowest RID (excluding the built-in administrator, unless it’s the only admin)
• -H : human-readable output for listing, or a confirmation message on reset

Practical Command Examples

First, mount the offline Windows partition and locate the SAM hive (typically under Windows/System32/config/SAM):

sudo mkdir -p /mnt/windows
sudo mount /dev/sda2 /mnt/windows
cd /mnt/windows/Windows/System32/config

1. Listing all users in the SAM database

sampasswd -l -u "*" SAM

Sample output:

RID      : 03e8  Username        : Administrator
RID      : 03e9  Username        : Guest
RID      : 03ea  Username        : john

2. Listing in human-readable mode

sampasswd -l -H -u "*" SAM

3. Resetting a specific user’s password by username

sampasswd -r -u john SAM

Expected result: no output on success (per the tool’s design), with an exit code of 0. Add -H to get an explicit confirmation message:

sampasswd -r -H -u john SAM

Sample output:

Password for user 'john' reset successfully.

4. Resetting a user by RID (useful for non-ASCII usernames)

sampasswd -r -u 0x3ea SAM

5. Resetting all administrator accounts

sampasswd -r -a SAM

6. Resetting the lowest-RID admin account automatically

sampasswd -r -f SAM

Real-World Use Cases (Authorized Lab Environments Only)

• Local Windows password recovery: IT support recovering access to a company-owned Windows workstation whose administrator password was lost, with proper authorization.
• Digital forensics: Investigators resetting a local account password on a forensic image copy to gain access for further authorized examination (never on the original evidence).
• Penetration testing labs: Demonstrating the offline-attack risk that unencrypted disks pose — anyone with physical access and a live USB can reset local Windows passwords without knowing the original credentials, which is exactly why full-disk encryption (e.g., BitLocker) matters.
• Sysadmin recovery scenarios: Regaining access to standalone (non-domain-joined) machines after credential loss, in environments where formal password-reset infrastructure isn’t available.

Workflow Integration

• chntpw suite: Sampasswd is typically used alongside reged (for registry-level tweaks, such as re-enabling a disabled account) and samunlock (for lifting account lockouts) as part of a complete offline recovery session.
• samdump2 → analysis: If the goal is understanding original password strength rather than just regaining access, use samdump2 to extract hashes for cracking with John the Ripper or Hashcat instead of Sampasswd’s overwrite approach.
• Live boot media: Commonly run from a Kali Linux live USB/DVD booted on the target machine, since Windows locks the SAM hive while the OS is running.

Performance Optimization

Sampasswd is a lightweight, near-instantaneous utility; there’s no meaningful performance tuning involved. The main “efficiency” consideration is correctly locating and mounting the right partition/hive before running any commands, to avoid wasted troubleshooting time.

Troubleshooting

Best Practices and Common Mistakes

• Only use Sampasswd on systems you own or have explicit written authorization to access — offline SAM manipulation is a powerful capability that bypasses normal authentication entirely.
• Always work on a backup or forensic copy of the SAM/SYSTEM hives when the goal is investigation rather than simple recovery, to preserve evidence integrity.
• Remember that Sampasswd resets passwords rather than revealing the original — if the objective is auditing password strength, use samdump2 plus a cracking tool instead.
• Combine with samunlock if the target account is also locked out, since a password reset alone won’t clear a lockout flag.
• Be aware this technique doesn’t work against full-disk-encrypted systems (e.g., BitLocker) without first unlocking the volume, which is itself a strong argument for enabling disk encryption.

FAQ

Does Sampasswd tell me the original password? No. It overwrites the password hash to blank it out; it does not recover or reveal the original plaintext password. For that, hashes need to be extracted (e.g., with samdump2) and cracked separately.

Can Sampasswd be used while Windows is running? No — the SAM hive is locked by the OS while Windows is booted. Sampasswd is meant to be used offline, typically by booting the target machine from a Kali Linux live USB.

Does this work against BitLocker-encrypted drives? Not directly. The volume must first be decrypted/unlocked (with the correct recovery key or password) before the SAM hive underneath becomes accessible to Sampasswd.

What’s the difference between Sampasswd and chntpw itself? chntpw is the main interactive tool for editing NT password/registry data, while sampasswd is a smaller, scriptable component focused specifically on resetting or listing SAM user passwords, useful for non-interactive/automated recovery scripts.

Summary

Sampasswd offers a fast, direct route to regaining access to a local Windows account by resetting its password straight in the offline SAM database — no cracking, no waiting, and no need to know the original credentials. As part of the broader chntpw toolkit, it’s a practical utility for IT recovery scenarios and a clear demonstration of why physical device security and full-disk encryption matter, since offline access to an unencrypted Windows drive makes password resets like this entirely possible.

References

• Kali Linux chntpw tool listing: https://www.kali.org/tools/chntpw/
• Sampasswd man page (Debian/Kali): available via man sampasswd after installing chntpw
• Upstream author’s project page: http://pogostick.net/~pnh/ntpasswd/