ProblemSo last night I challenged my young 8th grade brother to hack into the home computer.
I have reason to hate XP with a stirred passion.
I came home today (the next day) and he (from his limited account) had changed all the passwords of the accounts including my account which was an administrator account; however, he could not gain access to an account that had two names separated by the "&" symbol (eg. Greg & Ginger). This account was the first user created upon installation.
Go to
Total Results in red below and that will get the real answer to where this all began.
Method used to enterCommand prompt. There is no need to 'run as Administrator' as in Vista. Thus anyone can change your passwords and then enter your account.
HypothesisThis "&" is a way to protect your account.
Testplace the " on both sides of the name (eg. "Greg & Ginger") using command prompt
ResultI entered the account; the hypothesis is invalid.
However, going on with this problem that is going to become an adventure.
HypothesisWill this same thing work from a limited account on my other computer it is an XP with service pack 3 as well?
TestRun cmd from the limited account
Resultsunable to change any administrator accounts from this limited account.
The "System error 5 has occurred. Access is denied" comes
HypothosisCan I run a batch file from this limited account and add users?
Testwrite batch file to add 10 users
ResultsAs the batch file ran. The "System error 5 has occurred. Access is denied" was displayed every time a user was attempting to be added.
This user has no permission, in other words no ability to change anything, even through this pitiful command prompt program.
HypothesisCan I change the passwords of other administrator users on this (computer 2) as well from an administrator account?
TestOnce again, use command prompt, but from one of the admin accounts to change the password of another account.
ResultsYes, an administrator account can access anyone else including other admin users.
Let's think up something more effective.
Total ResultsAfter talking with my brother, he had actually had changed his account to administrator when he found my parents account logged in and ready to go. Log off when you are not physically at the computer. Users are the greatest weakness in this security.Little note on the end, my brother as well, created an admin account that he could access by going into safe mode and accessing Administrator account that no one had blocked by password or any other from of renaming. My brother gives thanks to Youtube.
After he gained access he began the same command prompt on the other computer though his new admin account and changed my password, etc.
Next... How to change the password and rename your Administrator account
...and then later how to script the process and have an Administrator user enabled through a back door.