Resetting a Windows Password Using the utilman.exe Method

A technical guide with explanations and real examples

---

📌 Context

• Operating system: Windows 10/11
• Situation: The local account password (e.g., john) has been forgotten.
• Objective: Reset the password without using a USB stick or reinstalling Windows.
• Method: Use WinRE (Windows Recovery Environment) and replace utilman.exe with cmd.exe to gain access to Command Prompt directly from the login screen.

What is WinRE?

• WinRE (Windows Recovery Environment) is a recovery environment built into Windows.

• It lives on a hidden recovery partition (for example, in the case below it was D: with 644 MB).

• WinRE provides troubleshooting tools like startup repair, system restore, and Command Prompt.

• When you enter WinRE, the command prompt runs from:

  X:\Windows\System32
  

  This is a temporary environment in memory, not your installed Windows.

  ❓ What is utilman.exe?

• utilman.exe = Utility Manager, the Windows application that opens from the Ease of Access button (bottom-right corner of the login screen).

• In this method, we temporarily replace it with cmd.exe (Command Prompt).

• As a result, when you press the Ease of Access button, Command Prompt opens instead — with SYSTEM privileges.

What are SYSTEM privileges?

• SYSTEM is the most powerful account in Windows, even above Administrator.
• Commands run as SYSTEM can access any file, modify any configuration, and reset any user password.
• By replacing utilman.exe with cmd.exe, we launch Command Prompt with SYSTEM privileges before login.

Why does this method work?

• At the login screen, Windows allows certain accessibility tools (like Narrator or On-Screen Keyboard) to run with SYSTEM privileges.
• By replacing utilman.exe (Utility Manager) with cmd.exe, we can trick Windows into running a SYSTEM-level Command Prompt.

---

🛠 Step-by-Step Guide

1. Enter Windows Recovery Environment (WinRE)

Two ways to access WinRE:

• From the login screen:
  Hold Shift → click Power → Restart.
• From boot:
  Press F11 or F8 (depending on manufacturer).

Then navigate to:

Troubleshoot → Advanced options → Command Prompt

When the prompt shows:

X:\Windows\System32

you are in WinRE.

---

2. Identify the Windows Partition

Run:

diskpart
list volume
exit

Example output:

Volume ###  Ltr  Label  Fs     Type       Size   Status   Info
----------  ---  -----  -----  ---------  -----  -------  ----
Volume 0     C          NTFS   Partition  243GB  Healthy
Volume 1          NTFS   Partition  232GB  Healthy
Volume 2          FAT32  Partition  100MB  Healthy  Hidden
Volume 3     D          NTFS   Partition  644MB  Healthy  Hidden

Interpretation:

• C: (243 GB, NTFS) → Installed Windows
• Volume 1 → Data partition
• Volume 2 (100 MB, Hidden) → Boot partition
• Volume 3 (D:, 644 MB, Hidden) → Recovery (WinRE itself)

---

3. Verify utilman.exe

Check if the file exists:

dir C:\Windows\System32\utilman.exe

Example:

01/04/2025  04:42 PM   299,008 Utilman.exe

This confirms Windows is on C:.

---

4. Backup and Replace utilman.exe

Backup the original file:

copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.exe.bak

Replace it with Command Prompt:

copy /y C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe

Why?

• .bak = backup, so we can restore later.
• Replacement ensures the Ease of Access button opens CMD with SYSTEM privileges.

Expected output:

1 file(s) copied.

---

5. Reboot Windows

wpeutil reboot

or

shutdown /r /t 0

---

6. Open Command Prompt at Login

• At the login screen, click the Ease of Access icon (bottom-right).
• Instead of Utility Manager, cmd.exe opens with SYSTEM privileges.

---

7. List Accounts and Reset Password

List accounts:

net user

Example output:

Administrator  DefaultAccount  Guest
john           WDAGUtilityAccount

Reset the password:

net user john NewPassword123!

Expected output:

The command completed successfully.

---

8. Log In

• Close CMD with exit.
• Enter the new password for your account (e.g., john).

---

9. Restore Security

Once inside Windows:

1. Open CMD as Administrator.
2. Restore the original file:

copy /y C:\Windows\System32\utilman.exe.bak C:\Windows\System32\utilman.exe

3. (Optional) Disable the hidden Administrator account:

net user Administrator /active:no

---

🔧 Troubleshooting: "Access is denied"

When restoring, you might see:

Access is denied.
0 file(s) copied.

Fix by taking ownership and resetting permissions:

takeown /f C:\Windows\System32\utilman.exe
icacls C:\Windows\System32\utilman.exe /grant administrators:F
copy /y C:\Windows\System32\utilman.exe.bak C:\Windows\System32\utilman.exe
icacls C:\Windows\System32\utilman.exe /setowner "NT SERVICE\TrustedInstaller"

---

✅ Conclusion

• WinRE = recovery environment stored on a hidden partition.
• SYSTEM privileges = highest level access on Windows, above Administrator.
• utilman.exe = accessibility app; replacing it lets you launch SYSTEM CMD before login.
• diskpart + list volume = helps identify where Windows is installed (C: with 243 GB in this case).
• .bak = backup copy of the original system file.
• net user = lists accounts and allows resetting local account passwords.

This method restores access to a locked local Windows account without reinstalling Windows or using third-party tools — as long as you can access WinRE.