Accessing and changing the registry from outside Windows
Problem: I got myself locked out of my pc
Solution: access the registry from outside Windows and change the account lockout settings
After enabling Remote Desktop access to access from my notebook to my pc through my wireless LAN, I was playing around with account locking settings to defend from possible brute force attacks coming through the WLAN (supposing the attacker cracked the WPA-PSK password): I set the lock so that after two failed attempts to login the account would be locked until the administrator (me) unlocks it manually.
I wanted to adopt such a security measure for RDP access only, but unfortunately the account lockout policy is valid for any login attempt, being it local or remote.
Then, as a slight security measure, I also disabled the administrator user (my user is already an administrator and an attacker should also find a valid username).
I mistyped the password twice and I got myself stuck: administrator and guest were disabled and my account was locked.
After rebooting, at the logon screen there were no more users, so that the "To begin, click your username" sentence on the left sounded like a joke, having absolutely nothing on the right.
The solution was obvious:
- try to access and change the registry from linux (I have dual boot)
- manually restore a previous version of the registry
I solved using Offline NTPassword & Registry Editor, an offline regitry editor on a boot disk; I made the floppy, rebooted and then I started looking in the registry the affecting keys, but it was not necessary: there's a feature to edit the accounts, and that allowed me to enable the administrator.
I also found dumphive, a useful program to dump the registry hives to text files.
Instead on www.beginningtoseethelight.org there's plenty of Windows NT, 2000 and XP low level settings and hacks, I would say "all about the registry": for instance, where and how users and passwords, including account statistics and policies, are stored and encoded in the SAM hive of the registry, and a schematic explanation of the registry structure; and don't miss the other sections of the site, they're enlightening too.
About the second option, there's a Microsoft article that explains how to manually restore the registry to a previous state.