{"id":408,"date":"2026-06-05T10:44:54","date_gmt":"2026-06-05T16:44:54","guid":{"rendered":"https:\/\/blog.d5.ca\/?p=408"},"modified":"2026-06-05T10:57:48","modified_gmt":"2026-06-05T16:57:48","slug":"reset-windows-password-using-utilman-exe-trick","status":"publish","type":"post","link":"https:\/\/blog.d5.ca\/?p=408","title":{"rendered":"Reset Windows Password using Utilman.exe Trick"},"content":{"rendered":"

TL;DR<\/h2>\n

Run these commands from a command prompt in Windows Recovery, while in the system drive:<\/p>\n

ren \\Windows\\System32\\utilman.exe utilman.bak\r\ncopy \\Windows\\System32\\cmd.exe utilman.exe<\/pre>\n
Restart and click the Accessibility icon on the welcome screen. Then reset the password from the command prompt that opens:<\/p>\n
net user Username NewPassword<\/pre>\n
<\/p>\n
The “Utilman” Method:<\/h2>\n
On your Windows lock screen, there is an Accessibility icon in the bottom right corner. Clicking it launches utilman.exe<\/code> (the Utility Manager), which gives you quick access to tools like the Magnifier and On-Screen Keyboard.<\/p>\n
By booting into a recovery environment, we can trick Windows by renaming the Command Prompt executable (cmd.exe<\/code>) to utilman.exe<\/code>. When you click that accessibility button on the lock screen, Windows will launch a fully privileged Command Prompt instead, allowing you to reset your password in seconds.<\/p>\n
\n
Important Note:<\/b> This method only works for Local Accounts<\/b>. If you log in using a Microsoft Account (e.g., yourname@outlook.com), you will need to reset your password via Microsoft’s official online recovery page.<\/p>\n<\/blockquote>\n
Step 1: Boot into Windows Recovery Environment (WinRE)<\/h3>\n
Since Windows won’t let you alter system files while it’s actively running, you need to boot into an external or recovery environment.<\/p>\n
    \n
  1. \n
    On the login screen, hold down the Shift key<\/b> on your keyboard.<\/p>\n<\/li>\n
  2. \n
    While holding Shift, click the Power icon<\/b> in the bottom right corner and select Restart<\/b>.<\/p>\n<\/li>\n
  3. \n
    Keep holding Shift until your screen goes blue and you see the Choose an option<\/b> menu.<\/p>\n<\/li>\n
  4. \n
    Navigate to: Troubleshoot<\/b> > Advanced options<\/b> > Command Prompt<\/b>.<\/p>\n<\/li>\n<\/ol>\n
    (Note: If your system drive is encrypted with BitLocker, you will be prompted to enter your BitLocker recovery key here to proceed.)<\/i><\/p>\n
    Step 2: Swap Utilman with Command Prompt<\/h3>\n
    Once the black Command Prompt window opens, you need to find your actual Windows installation drive (it’s often assigned a different letter like D:<\/code> or E:<\/code> in recovery mode).<\/p>\n
    1. Locate your Windows drive:<\/b> Type C:<\/code> and hit Enter, then type dir<\/code> and hit Enter. If you see folders like Program Files<\/code> and Windows<\/code>, you are in the right place. If not, try D:<\/code>, E:<\/code>, etc., until you find it. Let’s assume it is C:<\/code> for the rest of this guide.<\/p>\n
    2. Navigate to the System32 folder:<\/b><\/p>\n
    \n
    \n
    \n
    cd<\/span> C:\\Windows\\System32\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
    3. Backup the original Utilman file:<\/b><\/p>\n
    \n
    \n
    \n
    ren<\/span> utilman.exe utilman.bak\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
    4. Replace Utilman with Command Prompt:<\/b><\/p>\n
    \n
    \n
    \n
    copy<\/span> cmd<\/span>.exe utilman.exe\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
    5. Exit and reboot:<\/b> Type exit<\/code> and restart your PC normally.<\/p>\n
    Step 3: Reset Your Password<\/h3>\n
    Now for the magic trick.<\/p>\n
      \n
    1. \n
      Once you are back at the normal Windows 11 lock screen, click on the Accessibility \/ Ease of Access icon<\/b> in the bottom right corner.<\/p>\n<\/li>\n
    2. \n
      Instead of the accessibility menu, a Command Prompt window will pop open with System-level privileges.<\/p>\n<\/li>\n
    3. \n
      Type the following command to see your exact username:<\/p>\n
      \n
      \n
      \n
      <\/div>\n
      net<\/span> user\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n
    4. \n
      Now, type the reset command, replacing Username<\/code> with your actual account name and NewPassword<\/code> with whatever you want your new password to be:<\/p>\n
      \n
      \n
      \n
      <\/div>\n
      net<\/span> user Username NewPassword\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n
    5. \n
      Press Enter. You should see a message saying “The command completed successfully.”<\/p>\n<\/li>\n<\/ol>\n
      Close the Command Prompt window, type in your new password, and welcome back to your desktop!<\/p>\n
      Step 4: Cleaning Up (Crucial!)<\/h2>\n
      Leaving your system like this is a massive security risk, as anyone with physical access to your PC could open Command Prompt and change your password. You must reverse the process.<\/p>\n
        \n
      1. \n
        Repeat Step 1<\/b> to boot back into the Recovery Environment Command Prompt.<\/p>\n<\/li>\n
      2. \n
        Navigate back to System32:<\/p>\n
        \n
        \n
        \n
        cd<\/span> C:\\Windows\\System32\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n
      3. \n
        Delete the modified file:<\/p>\n
        \n
        \n
        \n
        del<\/span> utilman.exe\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n
      4. \n
        Restore the original backup file:<\/p>\n
        \n
        \n
        \n
        ren<\/span> utilman.bak utilman.exe\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n
      5. \n
        Type exit<\/code> and restart your computer.<\/p>\n<\/li>\n<\/ol>\n
        A Note on Windows 11 24H2 and Modern Security<\/h2>\n
        While this trick still works on standard installations up to Windows 11 24H2, Microsoft has been aggressively implementing security measures that can block it:<\/p>\n
          \n
        • \n
          Windows Defender \/ Tamper Protection:<\/b> In some modern updates, Windows Defender may flag the modified utilman.exe<\/code> as a threat upon normal boot and automatically delete or quarantine it. If the accessibility button does nothing when clicked, Defender likely blocked it.<\/p>\n<\/li>\n
        • \n
          Windows Hello PINs:<\/b> If you usually sign in with a PIN, changing the local password via net user<\/code> might force Windows to ask you to reset your PIN upon your next login.<\/p>\n<\/li>\n<\/ul>\n
          The Ultimate Defense:<\/b> If you want to protect your own PC from someone using this exploit against you, make sure to turn on BitLocker drive encryption<\/b>. BitLocker completely encrypts your hard drive, preventing anyone from tampering with utilman.exe<\/code> via the recovery environment without your master recovery key.<\/p>\n","protected":false},"excerpt":{"rendered":"
          TL;DR Run these commands from a command prompt in Windows Recovery, while in the system drive: ren \\Windows\\System32\\utilman.exe utilman.bak copy \\Windows\\System32\\cmd.exe utilman.exe Restart and click the Accessibility icon on the welcome screen. Then reset the password from the command prompt that opens: net user Username NewPassword<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"categories":[25],"tags":[],"class_list":["post-408","post","type-post","status-publish","format-standard","hentry","category-reference"],"_links":{"self":[{"href":"https:\/\/blog.d5.ca\/index.php?rest_route=\/wp\/v2\/posts\/408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.d5.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.d5.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.d5.ca\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.d5.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=408"}],"version-history":[{"count":5,"href":"https:\/\/blog.d5.ca\/index.php?rest_route=\/wp\/v2\/posts\/408\/revisions"}],"predecessor-version":[{"id":414,"href":"https:\/\/blog.d5.ca\/index.php?rest_route=\/wp\/v2\/posts\/408\/revisions\/414"}],"wp:attachment":[{"href":"https:\/\/blog.d5.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.d5.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.d5.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}