You can recover a forgotten Windows password on a dual boot system by booting into Ubuntu, mounting the Windows partition, and using the
chntpw utility to reset the SAM database. This method allows you to clear or set a new password without needing the original credentials, provided you have administrative access in Linux and physical access to the machine.
Prerequisites and System Preparation
Before attempting any password recovery, ensure that your Ubuntu installation is fully updated and that you have sudo privileges. The most critical requirement is knowing which partition holds your Windows installation. In a typical dual boot setup on a single hard drive, Windows often resides on an NTFS partition, such as
/dev/sda1 or
/dev/nvme0n1p3. You can identify this by running
sudo fdisk -l or
lsblk in the terminal. Look for partitions labeled "Microsoft basic data" or with the NTFS file system type.
If your Windows installation uses BitLocker encryption, this method will not work because the partition data is encrypted. You must disable BitLocker from within Windows first. If you cannot access Windows, you will need to recover the BitLocker key from your Microsoft account or other backup sources before proceeding. Additionally, ensure that Secure Boot is either disabled or that you are using a signed kernel module if required by your specific hardware, although standard Ubuntu kernels usually handle this well.
Installing the Password Reset Tool
The primary tool for this task is
chntpw, a command-line utility designed to interact with Windows SAM (Security Account Manager) files. Since it is not installed by default, you need to add it to your system. Open your Ubuntu terminal and update your package list to ensure you get the latest version of the tool.
sudo apt update
sudo apt install chntpw
This process may take a few minutes depending on your internet connection speed. Once the installation completes, verify that the tool is available by checking its version:
chntpw --version
Having
chntpw installed provides the necessary binaries to edit the registry hives where Windows stores user passwords. It is important to use the version from the official Ubuntu repositories rather than compiling from source, as this ensures compatibility with the current kernel and library dependencies.
Mounting the Windows Partition
With the tools ready, the next step is to make the Windows partition accessible to Ubuntu. Create a temporary directory to serve as the mount point. This keeps your file system organized and makes it easy to unmount later.
sudo mkdir /mnt/windows
Now, mount the identified Windows partition to this directory. Replace
/dev/sda1 with the actual device path you identified earlier. If your system uses NVMe drives, the path might look like
/dev/nvme0n1p3.
sudo mount /dev/sda1 /mnt/windows
If the mount fails with an error related to the file system being "dirty" or requiring a check, it means Windows was not shut down properly (e.g., Fast Startup was enabled). You can force the mount by adding the
-o force option, but be aware that this carries a slight risk of data corruption if the file system is truly damaged. A safer approach is to reboot into Windows, perform a full shutdown (holding Shift while clicking Restart), and then try mounting again.
sudo mount -o force /dev/sda1 /mnt/windows
Verify the mount was successful by listing the contents of the directory:
ls /mnt/windows/Windows/System32/config/
You should see files named
SAM,
SECURITY,
SOFTWARE,
SYSTEM, and possibly
DEFAULT. These are the registry hives containing the user account information.
Resetting the Password
Navigate to the config directory where the SAM hive is located. This is the core file that stores hashed passwords for all local user accounts.
cd /mnt/windows/Windows/System32/config/
Run
chntpw on the
SAM file. This will open an interactive menu.
sudo chntpw SAM
The tool will display a list of user accounts found in the hive. Select the username you wish to reset by typing their number or name. Once selected, you will see several options. To clear the password entirely, choose the option to "Clear (blank) user password." Alternatively, you can set a new password by choosing the option to set a new password. Clearing the password is generally safer and easier, allowing you to log in without a password and change it later via Windows settings.
After making your selection, confirm the changes by typing
y when prompted. The tool will write the changes back to the
SAM file. Exit the tool by typing
q.
q
Finalizing and Rebooting
Once the password has been reset, it is crucial to unmount the Windows partition to prevent any file system inconsistencies.
sudo umount /mnt/windows
You can now remove the temporary directory if desired:
sudo rmdir /mnt/windows
Reboot your computer. When the GRUB menu appears, select Windows to boot. You should now be able to log in with the blank password (if cleared) or the new password you set. Upon logging in, Windows may prompt you to create a new password immediately; follow the prompts to secure your account.
For more detailed guidance on managing dual boot configurations, refer to our guide on
Safely Separating Linux and Windows Operating Systems on a Single Physical Disk. Additionally, if you encounter issues with bootloader recognition after these changes, check out
Windows Won't Dual Boot with Ubuntu 24.04 LTS.
Frequently Asked Questions
Will this method delete my Windows files?
No, resetting the password does not affect your personal files, applications, or data stored on the Windows partition. The process only modifies the authentication records in the SAM hive. However, always backup important data before making system changes.
What if I don't know the root username?
chntpw lists all local user accounts when you run it against the SAM file. You can scroll through the list or look for familiar names. If you are unsure, you can try common names like "Administrator" or your own name.
Can I use this method on a Microsoft Account login?
No, this method only works for local offline accounts. If you log in with a Microsoft email address, your password is managed online. You would need to reset the password via the Microsoft website from another device.
Why did the mount fail with 'dirty' flag?
This happens when Windows uses Fast Startup, which hibernates the kernel instead of fully shutting down. To fix this, boot into Windows, disable Fast Startup in Power Options, and perform a full shutdown. Then retry the mount from Ubuntu.
Is it safe to use chntpw on modern Windows versions?
Yes,
chntpw supports Windows 7, 8, 10, and 11. It interacts with the standard SAM structure which remains consistent across these versions. Always ensure you are editing the correct partition to avoid accidental changes to other systems.