L0pht

[FMJGomerPyle]

for anyone who has ever used this program before:

it says it can get the NT hash from the registry if you have admin access to that computer but when i try it on my computer logged in as administrator it says: "Failure to connect to the registry" or something like that. what am i doing wrong?

Also:

if the registry method won't work, how do i go about getting the SAM file off a NT 4 workstation onto a floppy with admin access to the computer?

 

[Shadow07]

Are you running the program locally or remotely? If you are running it remotely, then you need to make sure that the Remote Registry service is running on the target machine.

 

[FMJGomerPyle]

i'm running it locally, but how do i enable the remote registry access anyway?

 

[Shadow07]

You have to enable it in the Services control panel applet. There you should see the Remote Registry Service.

Also, what service pack do you have installed?

 

[FMJGomerPyle]

oh yeah, i forgot to tell you i'm using 2000 not NT, service pack 1

 

[Gantry]

Not sure if this is relevant, but Win2000 has that syskey encryption on the SAM database, which I think has to be removed/decrypted before you can get to the SAM.

If you check the help file in the l0pht directory, they mention a program that can be used to dump your SAM database sans syskey. Unfortunately for me, this program did not work and I couldn't go on from there (see my thread below about accessing 2000 registry from a bootdisk)...

Hope this helps...