SpecialAccounts/UserList last Admin hidden

P

pitchzer0

Joined
May 15, 2017
Messages
1
Reaction score
0
Hey there,
because of a typo, a friend managed to "hide" the last admin-account via regedit HKLM/Microsoft/Windows NT/CurrentVersion/Winlogon/SpecilAccounts/UserList and now i can't think of a way to delete the entry without admin-privs. Anyone any ideas?
I can boot properly, login with the user accounts etc. but when UAC shows up, the only possible option is NO.
When i try to reboot into command line (Shift->restart) is just waits in boot screen stating "command line is prepared" (I cant give the right english translation becuse the system is localised).
All i need is getting admin-privs for the system. There are no security mechanisms like secureboot, bitlocker etc. in place.
Please help!
Greetz, pitch
 
Regedit32

Regedit32

Moderator
Joined
Mar 4, 2016
Messages
3,617
Reaction score
1,139
Hi pitchzer0,

Welcome to the Forum.

If I am reading your thread correctly, you can:
  1. Logon, but only with an account that does not belong to the Administrative Group
  2. Currently, your User Account that does belong to the Administrative Group is hidden

If I understood correctly, then all you need to do is the following:
  • Logon to Desktop
  • Open File Explorer and navigate to C:\Windows
  • Scroll down to locate Regedit.exe
  • Press and hold your Shift key down and right-click on Regedit.exe and select Run as different user
Sample image

Untitled.png
​
  • Enter the Username that is hidden and that accounts password
  • When prompted by the User Account Control, click Yes
  • Now simply copy & paste the following into your Registry Editor Address bar:
Code: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Press Enter key

Right-click on the Username you want to be able to see again, and either select delete or modify and set Data value to 0

Press F5 key to refresh Registry

Close Registry Editor

Restart computer

Once you log back in with your Administrator account I'd suggest opening an elevated command prompt and removing the Userlist key and/or the SpecialAccounts key; neither of which belong there.

To remove Userlist key

Copy & paste the following into an Administrator: Command Prompt

Code: 
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /f

Press Enter key

To remove SpecialAccounts key (which will also remove any sub-keys; i.e. UserList)

Copy & paste the following into an Administrator: Command Prompt

Code: 
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts" /f

Press Enter key​


Regards,

Regedit32


​
 
Top