Personal laptop joined to domain with expired cached credentials

majestic_pecan

I'm hoping someone can help me out here and that there's a command I've forgotten about...
I have a friend who purchased a laptop and immediately joined it to the domain where he worked. He stopped working there, but never thought to unjoin his PC from the company domain. For the last 90 or so days, he's been logging in with cached credentials. Now, the credentials have expired and he cannot login to the PC at all. He doesn't know/remember the local administrator account username or password.
Is there a way to use the command line in PXE to unjoin this machine from the domain (which he no longer has access to) or am I just going to have to help him use a third party password recovery tool at this point?
OS is Windows 8.1, machine is Lenovo Thinkpad.

scaredoftests

Go into safe mode, no networking?

Mike7

Since he does not know his local admin account, his domain account credentials has expired, and he has stopped working at the company, get a third party tool to reset local admin password.

gespenstern

^ but watch out for bitlocker and/or EFS. Bitlocker, which many companies use, will totally prevent you from resetting a password and, unless you know your bitlocker key, your only option in this case is scrap this windows installation and install from scratch. EFS encrypted files will be lost after resetting a password with a 3-rd party tool.

And... hopefully lesson will be learned and your buddy will show more responsible approach to this matter next time...

cyberguypr

Ah! The beauty that BYOD is (NOT). I don't know what troubles me more, people joining their PCs to corporate domains or companies letting people do this.

Mide

Just DL a tool to a CD to break into the SAM DB and clear the password.

srabiee

Hiren's Boot CD has tools to allow you to reset the local administrator account.

majestic_pecan

gespenstern wrote: »

^ but watch out for bitlocker and/or EFS. Bitlocker, which many companies use, will totally prevent you from resetting a password and, unless you know your bitlocker key, your only option in this case is scrap this windows installation and install from scratch. EFS encrypted files will be lost after resetting a password with a 3-rd party tool.

This was precisely what happened. Luckily he was able to call his old company's help desk and they provided him with the Bitlocker recovery key.
Afterwards I came across an interesting (?) workaround in Windows 8 which allowed me to replace the Ease of Access application at the log on screen with the command prompt, use said command prompt to create a user and add it to the local admin group and get him in to unjoin the PC. Seems very vulnerable to a hacker though.
Thanks guys.

OctalDump

majestic_pecan wrote: »

Afterwards I came across an interesting (?) workaround in Windows 8 which allowed me to replace the Ease of Access application at the log on screen with the command prompt, use said command prompt to create a user and add it to the local admin group and get him in to unjoin the PC. Seems very vulnerable to a hacker though.
Thanks guys.

Once the hacker has physical access to the device, game over. Could use the TPM to encrypt the drive.

maelstrom3530

Yeah that's the whole point of BitLocker. Without being able to decrypt the drive, good luck replacing Ease of Access with cmd.exe.