Windows – using “runas” with “Administrator” account versus other admin accounts

I have two answers for you.

The first is not a solution to your immediate problem but still... Reinstall the system.

Sure, I might be a bit over obsessive about safety, but for me that's quite a risk to run a system somebody else configured. It just has security risk written all over it. :P

The second solution is actually an answer to the problem - how to get admin privileges on a Windows machine you have physical access to.

• boot the machine into live linux distribution - Debian/Ubuntu/etc
• mount the windows system partition
• cd into mounted-partition/Windows/System32 and backup osk.exe, that's On Screen Keyboard executable. After doing that, replace it with cmd.exe - like cp -f ./cmd.exe ./osk.exe
• reboot into Windows, on the login screen click on the Ease of Access icon on the left bottom, and choose the On Screen Keyboard. This will run cmd.exe
• in the console window type: net user user_name new_password to reset admin account password. You can then log into that account and do whatever you please.
• of course you need to undo the changes you've made. ;)

Since the problem is that you have added registry entries to hide the Administrator account, you have basically managed to make unavailable your only enabled administrator account. For reasons you have already found out, Windows takes special care to ensure that there is always at least one such functioning account, but you have found one way of circumventing all these safeguards.

So basically the problem is narrowed down to how to delete these registry entries without using regedit. They are found in the registry at the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList. Deleting the whole SpecialAccounts branch is probably the best.

There are numerous ways of modifying the registry in an unrestricted manner and without booting into Windows and numerous articles describing them. For example, this article details four such methods : 4 Ways to Edit Registry Key Values Without Booting into Windows.

1. PC Regedit
2. Hiren’s Boot CD and its Mini Windows XP feature
3. Lazesoft Recovery Suite Home
4. UBCD4Win

A fifth method, if you have a Windows installation disk or a System Repair Disc, is to boot from it into the Command Prompt and use regedit. See the article How to Reset a Windows Password in Regedit at Boot.

However, all of the above methods involve using a boot CD/USB. If, as you say, you currently don't have access to that, you are in a bad way. Please explain why you have that restriction.

Without being able to boot a CD or USB, the only other solution I can think of is to take the Windows system disk out of the computer, add it as a secondary disk in a functioning Windows 7 computer, and use its regedit to open the HKEY_LOCAL_MACHINE hive and delete the SpecialAccounts branch, as described in Load or Unload Registry Hives.

The HKEY_LOCAL_MACHINE\SOFTWARE hive is located in the file \Windows\System32\config\SOFTWARE. You need to open regedit, click on HKEY_LOCAL_MACHINE, then use the menu File -> Load Hive command. After editing, use File -> Unload Hive.