[Dshield] Windows Startup Password?

Powers, James L. JLPowers at cmhmetro.net
Thu May 9 16:10:38 GMT 2002


Sound like it was SYSKEY'd at some time.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q143475

"Windows NT will prompt for the System Key password when the system is
in the initial startup sequence, but before the system is available for
users to logon. The System Key password is not stored anywhere on the
system. An MD5 digest of the password is used as the master key to
protect the password encryption key."

> -----Original Message-----
> From: Wayne Beckham [mailto:wbeckham at co.riverside.ca.us]
> Sent: Thursday, May 09, 2002 11:22 AM
> To: list at dshield.org
> Subject: [Dshield] Windows Startup Password?
> 
> 
> Has anyone run across this and, if so, have any suggestions?
> 
> After an employee was terminated a particular server was 
> found to sprout a "windows startup password."  This is before 
> reaching the UserId/Password and after Win2K loads.  The 
> operation appears similar to Blackboard Software's "WinLock" program.
> 
> None of the Network services load and the machine is not 
> accessible from the network.
> 
> The machine is an older box, but has critical data for a 
> particular department.  Normally, I'd grab the drives and 
> recover them in another PC, but this is a REALLY old machine 
> and we don't have spare servers laying around.
> 
> Any assistance at all would be greatly appreciated.
> 
> - Wayne
> 
> Wayne Beckham
> LAN Administrator
> Riverside County
> 
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see: 
> http://www.dshield.org/mailman/listinfo/list
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3022 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/list/attachments/20020509/2c00f851/smime.bin


More information about the list mailing list