How Does This Hacking Method Work?

Sticky Keys is part of Windows Ease of Access features that allows a user to tap the Shift, Ctrl, Alt or Windows key once to achieve the same effect as holding the key down. If you press the SHIFT key 5 times in a row at Windows login screen, the Sticky Keys application (sethc.exe) will launch and ask if you want to enable sticky keys feature.

This hacking method works by replacing the sethc.exe file with cmd.exe. When you boots to Windows login screen, pressing the SHIFT keys 5 times will launch an elevated Command Prompt. From the Command Prompt, you have sufficient privileges to reset a lost password without knowing your current password. This method works flawlessly with all versions of Windows XP, Vista, 7, 8, 8.1 and 10.

Part 1: Replace Sticky Keys application with Command Prompt

When you’re locked out of Windows 10 or lose admin access to your computer, it’s impossible to replace the sethc.exe file from within Windows. To achieve this, you have to boot from a WinPE or Linux-based disc. Here we’ll use a Windows 10 installation DVD to demonstrate how to replace sethc.exe with cmd.exe. Follow these steps:

1. Boot your locked computer using your Windows 10 installation DVD. If your computer doesn’t boot from it, you might need to change the boot order and disable UEFI secure boot.

   

2. After loading the installation files from the DVD, you’ll be shown the language setup screen. Just press SHIFT + F10 key combinations to launch the Command Prompt.

   

3. Use the dir command to find the drive where your Windows was installed. Note that the drive letter for your Windows partition could be D:\ or other as C:\ might be assigned to the System Reserved partition after booting into a Live CD.

   

4. Enter the following two commands one by one, press Enter after each. Replace c:\ with the correct drive letter if Windows is not mounted on c:.
   copy c:\windows\system32\sethc.exe c:\
copy /y c:\windows\system32\cmd.exe c:\windows\system32\sethc.exe
   The first command backs up the sethc.exe file, and the second replaces it with the cmd.exe.

   

5. Next, run the following commands to disable Windows Defender as it may detect the sticky keys trick as a security alert called “Win32/AccessibilityEscalation“.
   reg load HKLM\temp-hive c:\windows\system32\config\SOFTWARE
reg add "HKLM\temp-hive\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
reg unload HKLM\temp-hive

   

6. Now close everything and cancel Windows Setup. Remove the installation disc and reboot.

   

Part 2: Reset Windows 10 Password from Login Screen

1. Once you get back to Windows 10 login screen, press the SHIFT key 5 times in a row, it will open the Command Prompt in administrator mode.

   

2. Enter the following command to reset your lost Windows 10 password. Substitute the name of the account to reset and a new password as appropriate. If you don’t know your account name, just type net user to list the available user names.
   net user user_name new_password

   

3. Close the Command Prompt and you can now login with your new password. After logging in, remember to restore the sethc.exe file we overwrote in step 4, and turn on Windows Defender real-time protection. Enjoy!

Conclusion

This sticky keys method is quite well known and could be used to break into any Windows-based computer as long as you have physical access. So you might ask how can I prevent someone from hacking my Windows password? Just set a BIOS password to lock the boot sequence so others can’t boot from CD/USB.

To make password recovery easier than even before, we’ve developed a software for both beginners and advanced users –  PCUnlocker, which allows you to reset a forgotten Windows password or create a new admin account to access your locked PC.

Part 1: Create A UEFI Bootable USB Drive

Before resetting Windows 10 password, you need to prepare a UEFI compatible bootable disk, which can be done from another computer you have access to. Here’s how to make such a disk:

1. Download the utility PCUnlocker Enterprise and save it to your local hard drive. PCUnlocker Enterprise comes in two architectures: 32-bit and 64-bit. If your Acer Switch laptop comes with Windows 10 32-bit, please use the 32-bit version of PCUnlocker Enterprise. Otherwise you have to use 64-bit version correspondingly.
2. The downloaded file comes as a .zip file. Decompress it and you’ll see two files: pcunlocker.iso and ReadMe.txt. Use the freeware ISO2Disc to burn the pcunlocker.iso file to your USB drive. Make sure you choose the “GPT (required for UEFI boot)” option as ISO2Disc will partition your USB drive with GPT partition table.

   

Part 2: Acer Aspire Switch Password Reset

1. Use an OTG USB adapter to connect the USB drive to your Acer Aspire Switch laptop. When it’s powered off, press and hold the Volume Up button, then press the Power button. Release both when the laptop starts. Now you’re in the BIOS menu. Another way to access the BIOS is repeatedly press the F2 key when powering on the machine.
2. Once in the BIOS, select the Main tab. click on “F12 Boot Menu” to set it to Enabled.

   

   Switch to the Boot tab, rearrange the boot priority order and set USB HDD as the first boot media. Save your changes and exit.

   

3. Now the computer will reboot from your plugged USB drive. After loading, the PCUnlocker program will launch and you can see a list of Windows accounts for your system.

   

4. Choose a local account and click on Reset Password. It will quickly unlock / remove your forgotten Windows 10 user password. If the local account is linked to your Microsoft account, the program will automatically switch your login back to local account so next time you can log in to Windows 10 without a password!

You can also use this method to reset lost Windows 10 or 8 password on the other brands of computers running with UEFI secure boot.

Requirements:

The following things are needed before you begin:

• A USB thumb drive with at least 1Gb space (USB 3.0 is recommended as Surface has a full-size USB 3.0 port).
• PCUnlocker Enterprise
• A USB burning tool – ISO2Disc

How to Reset Windows 10 Password on Surface Book & Surface Pro 4?

The first thing you’ll need to do is download the zip file of PCUnlocker Enterprise (trial version) to a computer you have access to. When the download is complete, extract the contents of the ZIP file using 7-Zip or your favorite unzip program. You should see a file called pcunlocker.iso.

Download and install the freeware ISO2Disc. With your USB thumb drive plugged in, launch ISO2Disc. Click on Browse button to select the PCUnlocker ISO image you’ve downloaded. Click on “Burn to USB Flash Drive” option and select your USB drive, next choose “GPT (required for UEFI boot)“.

Click on Start Burn. Wait until ISO2Disc utility erases your USB drive and transfers PCUnlocker ISO file to it. When this is completed, close ISO2Disc utility, unplug the USB stick and use it to troubleshoot your locked Surface computer.

Insert the PCUnlocker Live USB drive into the USB 3.0 port on your Surface. Press and hold the Volume Down (-) button on the top edge of the device’s screen, then press the Power button. When the Surface logo appears, release Volume Down button and the machine will now boot from the USB drive.

Once booted to the PCUnlocker program, you can see all your Windows user accounts. Select an account from the list and click on “Reset Password” button. The program will remove your forgotten password immediately. If the account you selected is linked to a Microsoft account, PCUnlocker will automatically help you switch the Microsoft account back to local account.

Click on Restart button. While rebooting, unplug the USB drive and let the Surface boot from hard drive normally. When comes to the login screen, just click on your user icon and you can log on to your Surface Book or Surface Pro 4 without typing a password! That’s it!

The credentials of Microsoft account are stored in Microsoft’s cloud, so if you forgot the password you can use Microsoft’s online password reset page to reset your password easily. However, if you’re unable to pass the security checks from Microsoft’s online form, that method won’t work. In this tutorial we’ll show you another way to log back into Windows 10 by offline switching your Microsoft account to local account. The procedure can be divided into 4 parts.

Part 1: Create A Bootable CD

As you’re already locked out of Windows 10 PC, you have to use another computer to make a boot CD. Download the CD image (trial version) of PCUnlocker and save it to any folder on your local hard drive, then use the freeware ISO2Disc to burn the ISO file to a blank CD (or USB thumb drive).

Part 2: Boot from CD

Put the CD into the optical drive of your locked Windows 10 PC. To boot from the CD, you might have to enter into the BIOS (UEFI) Setup and set the boot sequence to use CD/DVD-ROM as the first boot media. If you don’t know how to access your BIOS, please check your computer’s manual or this article: How to Set Your Computer to Boot from CD or USB Drive

Part 3: Switch Microsoft Account to Local Account

After booting successfully from the CD, you’ll be taken to the PCUnlocker program. From there you will see a list of all the local accounts available on your computer. Please note that one of your local accounts was automatically associated with your Microsoft account, and you’ll find out your email address displayed under the Description column.

Select the associated local account and click on “Reset Password” button. The program will switch your Microsoft account to local account and afterwards reset the local user password.

Part 4: Login to Windows 10

Take out the CD and reboot your computer. When it boots to Windows 10, you can see the underlying local account shown at the login screen. Click on that account and you can login without typing a password! Once logging in, you can access any local files associated with your previous Microsoft account.