Odd Windows 8.1 scenario

[mikeymikec]

A customer had forgotten their Windows login password (don't ask) - not a Microsoft account, just a standard local account, and the computer is telling me that the user is already logged in but has locked the workstation. Due to the fact that this computer doesn't have any other accounts to log in with and the customer couldn't remember the password (we tried a load of passwords that the customer normally uses for other things), I planned as a worst case scenario to back up the data, wipe it and start over. I was going to try ntpasswd on it before that, but I've had limited success with it and Win8x.

So anyway, I got the computer home and started it today. When it booted, it booted straight to the desktop (ie. it didn't ask for a password), furthermore in PC Settings it lists the account as having no password, and to make things super weird, when I ran NET USER <username>, it said that the password had been changed five minutes after that user had last logged in.

Cue creepy music.

 

[ArisVer]

Is there any malware that does this?

 

[Puffnstuff]

I'd immediately run malwarebytes and see if a keylogger is installed on it.

 

[Ketchup]

So, did you actually see the computer do this to the customer? If so, I'm with Puffnstuff. See what's on there.

I do find it odd that the customer had a password, forgot it, then the computer goes all the way to the desktop without one?

 

[mikeymikec]

Ok, it seems to be simpler than that yet odder. The user account asks for a password (only to unlock) even though it doesn't have a password (pressing Enter when the password box is presented allows me through). I've tried setting one then removing it, but it hasn't helped.

I just could have sworn that when I was first trying to access the laptop with various passwords, I tried not typing anything in then too.

 

[Ketchup]

The 10 preview does the same. Odder? Stupid is the word you're looking for, lol.

 

[mikeymikec]

The 10 preview does the same. Odder? Stupid is the word you're looking for, lol.

I wonder what triggers the problem in Win8x though, because I've set up plenty of Win8x workstations without login passwords, and the lock screen simply shows the user's avatar and name, you click on it, and it lets you in.

 

[pcgeek11]

I'll bet that they cleared the password and forgot.

Also if you have the check box marked "On resume display logon screen" in the screensaver settings window it will ask for a logon password even if there isn't one.