Can you recover a lost Admin user account?

Hi

I tried to setup a second user on my Mac and run them both as Admin users. When i swtiched over to the the secondary Admin user and logged back in, i couldn't see the primary Admin user. I tried to logging out/restarting/shutting down to login as the primary Admin user but it cannot find the account. It seem to have deleted this account as when i'm logged in as the secondary Admin user there is only the one account visible in the Accounts settings in the System Preferences.

Is there a way to either recover this 'lost' account or somehow access its files, folders and program settings (like iCal or Address Book) or is i gone forever?

Stupidly, my work is only backed up until mid August so i would lose 8 weeks work, plus all the contacts and calendar dates in those two aformentioned programs. Please don't tell me i'm staring down the barrel of a full format????

Thanks for your help

Karl

check in netinfo. It is possible it is just not showing up in the startup pane. if it is in netinfo, the account still exists, and u could log in via Terminal ('login username', then ur password at the prompt, or u could login by changing the system preferences to display a name and password prompt, instead of having the account names allready there when u log in. then copy all of your important files to the alternate admin account, and make it ur primary.

Thanks, but there is nothing there by way of the old primary admin user account, so i guess i have lost access to this data for good! A full reinstall beckons...

If you can't get to the Admin account and you need to reinstall…

during the reinstall select "Archive and Install," then select Preserve Users and Network Settings to save your existing files, users, and network settings.

I would think that the new Admin would be able to get to all of the data.

Boot from the CD. When the first instal screen comes up, go to the task bar and look for an option to reset password. It will allow you to reset the password for ANY account.....

or would this work?

----------------

Exploit

Step 1) Restart the computer (or turn it on if it's already off) while holding down the command and s keys at the same time. (If the computer is running Mac OS Public Beta, just press the s key.) They have root privileges at this moment, but now it's time to take advantage of these privileges.

Step 1.5) Type "/sbin/fsck -y". (Type this without the quotes, of course.) (This step really isn't necessary at all, but it just takes a second, and they might as well just do a quick check of the hard disk before mounting it.)

Step 2) Type "/sbin/mount -wu /" (This mounts the volume "/" with read/write access.)

Step 3) Type "/sbin/SystemStarter" (This starts the network services, which is necessary to gain access to NetInfo.)

Step 4) Here, one could now just type "passwd root" and override the existing root password with one of their own, or worse yet, someone could just get the current root password (and/or the administrative user account password) so the administrators of that computer don't know that their security has been compromised. One of the easiest ways to do this is to just type "nidump passwd ." and write down the root account's password hash. (The hash will be the text that looks like just a garbled mess of alphanumeric characters between two colons.)


Step 5) Now one can type up what they wrote down into a plain text file like the following example: "root:rQkFQ37SYveHw:0:0::0:0:System Administrator:/var/root:/bin/tcsh".

Step 6) Finally, they'll use a cracking program like John the Ripper for the PC, or the Meltino, a Classic Macintosh application, to crack the password hash.

And when it's finally cracked it, they've got the password


3) Capitalization Matters! "/sbin/SystemStarter"

Posted: February 27, 2004, 5:21 pm Post subject

Savers, the problem with that is you need the pass word in order to change the pass word. It will ask for the old pass word, then ask you for the new pass word. This only happens when change the root pass word. If root is changing a regular users pass word then the old pass word is not needed.

can you just delete the password file that holds the admin password and be done with it?

savers said:

can you just delete the password file that holds the admin password and be done with it?

Click to expand...

If you want to bring a unix system down hard, delete the pass word file.