Windows Server 2008 R2 Administrator account Cloning method (text) _win server

Reminder: To make the unexpected happen, back up the Sam file first.

1. First go to the registry, locate the Sam file, the location is Hkey_local_machine\sam\sam, by default, all the subkeys below the Sam are hidden, right-click Sam, and select permissions in the right-click menu.

2. In the Permissions dialog box that appears, change the permissions of the Administrators user group to full Control, and then click Apply to determine.

3. Click the "View" menu----"Refresh" to see that the child below the SAM is already out.

4. Under Sam--"Domains"-"account"-"Users", you can see that there are a number of items, where "000001f4" is the corresponding entry for the administrator account, and "000001f5" is the Guest account The item corresponding to "Guest".

5. Right click on the guest account corresponding to the item, click to select Export Registry file, and save to 1.reg.

6. Click 1.reg to select Edit, you can see that there are F and V binary values, delete the V value, and the F value copied to the Guest account. The registry value 000001F4 changed to 000001f5 and then saved.

7. Import 1.reg into guest, test, login to the system with the Guest account, you can see that already has the restart, shutdown and other administrator account permissions.

Summary: It is important to strengthen user account management, if you want to prevent unauthorized personnel intrusion, first of all to control the registration of access rights, and the daily use of computers, do not use an account with too large permissions.

For example: Install Server dog, McAfee and other software, can prevent account from being cloned.

This article comes from the "High Stability 51CTO Blog" blog