Mike's PBX Cookbook

CallPilot Server Password Reset

If the CallPilot Server (WindowsNT/2003) password is unknown, the recommended action is to re-image CallPilot!
However, you may have some luck with the following procedure, which can be used to make a backup, or record settings.

WARNING! This is an absolute last ditch solution. We shouldn't even be here. Perhaps your password policy needs reviewing?

Connect a keyboard, monitor & mouse to the CallPilot server, and follow the instructions below. CallPilot must have been properly shutdown. If this is in doubt, boot into "Safe Mode" by pressing F8 (multiple times) and choosing 'Shut-Down' before continuing.

Download one of the following:

The CD image (cd140201.zip) expands to cd140201.iso which can be directly burnt to a CD.
For a USB thumbdrive, copy all the files to root, and make it bootable (X:syslinux.exe -ma X:).

We can use this utility to reset the CallPilot Server 'Administrator' user password.

DISCLAIMER! This software comes with absolutely no warranty whatsoever. Use it at totally your own risk!

The example below is from a 600r. CAREFULLY follow the menu prompts!

Example:

1Boot from the CD (or USB thumbdrive) - this may require the BIOS boot order to be changed.
When successful, you'll see the following screen:

ISOLINUX 3.51 2007-06-10  Copyright (C) 1994-2007 H. Peter Anvin

***************************************************************************
*                                                                         *
*  Windows NT/2k/XP/Vista Change Password / Registry Editor / Boot CD     *
*                                                                         *
*  (c) 1998-2007 Petter Nordahl-Hagen. Distributed under GNU GPL v2       *
*                                                                         *
* DISCLAIMER: THIS SOFTWARE COMES WITH ABSOLUTELY NO WARRANTIES!          *
*             THE AUTHOR CAN NOT BE HELD RESPONSIBLE FOR ANY DAMAGE       *
*             CAUSED BY THE (MIS)USE OF THIS SOFTWARE                     *
*                                                                         *
* More info at: http://pogostick.net/~pnh/ntpasswd/                       *
* Email       : pnh@pogostick.net                                         *
*                                                                         *
* CD build date: Sun Sep 23 14:15:35 CEST 2007                            *
***************************************************************************

Press enter to boot, or give linux kernel boot options first if needed.
Some that I have to use once in a while:
boot nousb          - to turn off USB if not used and it causes problems
boot irqpoll        - if some drivers hang with irq problem messages
boot nodrivers      - skip automatic disk driver loading

boot:

Press <enter> to continue with the boot process.

2You will be prompted to select the Windows partition:

=========================================================
* Step ONE: Select disk partition where the Windows installation is
=========================================================
n device bytes   GB  MB === DISK PARTITIONS:
  
1 sda1 30716248 29 29996
2 sda2 10241437 9 10001
3 sda3 10241437 9 10001
4 sda4 20482875 19 20002
  
29996 MB partition sda1 is NTFS. Found windows on: WINDOWS/system32/config
10001 MB partition sda2 is NTFS. No windows there
10001 MB partition sda3 is NTFS. No windows there
20002 MB partition sda4 is NTFS. No windows there
=========================================================
  
--- Possible windows installations found:
  
1 sda1           29996MB  WINDOWS/system32/config

Please select partition by number or
 q = quit
 d = automatically start disk drivers
 m = manually select disk drivers to load
 f = fetch additional drivers from floppy / usb
 a = show all partitions found
 l = show propbable Windows (NTFS) partitions only
Select: [1]

Note the disk partitions listed, and press 1 (and/or <enter>) to choose partition #1

3When the partition has successfully mounted, the following is displayed:

=========================================================
* Step TWO: Select registry files
=========================================================

-rwxrwxrwx    1 0        0          262144 Jan  2  2002 SAM
-rwxrwxrwx    1 0        0          786432 Jan  2  2002 SECURITY
-rwxrwxrwx    1 0        0          262144 Jan  2  2002 default
-rwxrwxrwx    1 0        0        13893632 Jan  2  2002 software
-rwxrwxrwx    1 0        0        11345920 Jun 13  2006 software.sp
-rwxrwxrwx    1 0        0        31457284 Jan  2  2002 system
-rwxrwxrwx    1 0        0         2490368 Jun 13  2002 system.sp
drwxrwxrwx    1 0        0            4096 Mar 15  2012 systemprofile
-rwxrwxrwx    1 0        0          262144 Jun 13  2006 userdiff

Select which part of registry to load, use predefined choices
or list the files with space as delimiter
1 - Password reset [sam system security]
2 - RecoveryConsole parameters [software]
q - quit - return to previous
[1] :

4The default choice (1) is for password reset, hit <enter>

=========================================================
* Step THREE: Password or registry edit
=========================================================
chntpw version 1.00 140201, (c) Petter N Hagen
Hive <SAM> name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c <lf>
File size 262144 [40000] bytes, containing 9 pages (+ 1 headerpage)
Used for data: 334/28520 blocks/bytes, unused: 15/8056 blocks/bytes.

<>========<> chntpw Main Interactive Menu <>========<>

Loaded hives: <SAM>

  1 - Edit user data and passwords
  2 - Syskey status & change
  3 - RecoveryConsole settings
      - - -
  9 - Registry editor, now with full write support!
  q - Quit (you will be asked if there is something to save)


What to do? [1] ->

5Select 1 for password edit, hit <enter>

===== chntpw Edit User Info & Passwords ====

| RID -|---------- Username ------------| Admin? |- Lock? --|
| 01f4 | Administrator                  | ADMIN  |          |
| 03f1 | ASPNET                         |        |          |
| 03f0 | cpanonftp                      |        |          |
| 03ef | cpfilexfer                     |        |          |
| 01f5 | GuestNotAllowed                |        | dis/lock |
| 03e8 | IUSR_CALLPILOT                 |        |          |
| 03e9 | IWAM_CALLPILOT                 |        |          |
| 03ec | SUPPORT_388945a0               |        | dis/lock |
  
Please enter user number (RID) or 0 to exit: [1f4] 

6Hit <enter> to continue with the Administrator RID

- - - - User Edit Menu:
 1 - Clear (blank) user password
(2 - Unlock and enable user account) [seems unlocked already]
 3 - Promote user (make user an administrator)
 4 - Add user to a group
 5 - Remove user from a group
 q - Quit editing user, back to user select
Select: [q] > 1
Password cleared!

7Enter "1" to reset/clear/blank the password, confirm that the account is unlocked, and "q" to quit.

Hives that have changed:
 #  Name
 0  <sam> - OK

=========================================================
* Step FOUR: Writing back changes
=========================================================
About to write file(s) back! Do it? [n] : y

8You must answer "y", or the changes will not be saved.
- only registry files that have changed are written back.

***** EDIT COMPLETE *****

You can try again if it somehow failed, or you selected wrong
New run? [n] : n
=========================================================

* end of scripts.. returning to the shell..
* Press CTRL-ALT-DEL to reboot now
* or do whatever you want from the shell..
* You may also restart the script procedure with 'sh /scripts/main.sh'

/  #

9Remove the CD, and press CTRL-ALT-DEL to reboot the server.
You should now be able to log into the CallPilot server as 'Administrator' with a blank password.

10Open Start ➤ Programs ➤ Administration Tools ➤ Computer Management

11Select Local Users and Groups ➤ Users

12Right-click the 'Administrator' user, and Proceed to change the password to Bvw250 (default).