How to Reset a Forgotten Windows Password (Utilman Trick)

How the Utilman Trick Works

The Windows login screen shows an Ease of Access button in the bottom-right corner that launches Utilman.exe, the Utility Manager. Critically, that button runs before you log in, with SYSTEM-level privileges, because accessibility tools need to be available before authentication. If you replace Utilman.exe with cmd.exe using offline recovery media, clicking that button at the login screen gives you a full SYSTEM command prompt — no password required — which you can then use to reset the local account password. This works because you're editing the offline Windows partition from outside the running OS, where normal file protections and login gating don't apply.

What You Need

• A Windows 10 or 11 installation USB, or any bootable Windows PE/recovery media (create one with the Media Creation Tool on another PC if you don't have one).
• Physical access to the locked machine and the ability to boot from USB (you may need to change the boot order or hit a one-time boot key like F12/Esc).

Step 1: Boot Into Recovery / Setup From USB

1. Insert the Windows installation USB and boot from it (adjust boot order in BIOS/UEFI or use the one-time boot menu).
2. On the language selection screen, press Shift + F10 to open a Command Prompt. (If you booted straight into the blue recovery environment instead, go to Troubleshoot > Advanced options > Command Prompt.)

Step 2: Identify the Windows Drive Letter

In the recovery environment, drive letters often don't match what you're used to — Windows might be on D: instead of C:. Check with:

wmic logicaldisk get caption

Or simply try dir C:\Windows and adjust the letter until you find the one containing your Windows installation.

Step 3: Swap Utilman.exe for cmd.exe

Assuming Windows is on D:, back up the original Utilman first, then replace it:

copy D:\Windows\System32\Utilman.exe D:\Windows\System32\Utilman.exe.bak
copy D:\Windows\System32\cmd.exe D:\Windows\System32\Utilman.exe

Type exit, then close Setup or restart back into the normal Windows boot (remove the USB so it doesn't boot from it again).

Step 4: Trigger the Command Prompt at the Login Screen

1. At the Windows login screen, click the Ease of Access icon (bottom-right corner) — this now launches a SYSTEM-level Command Prompt instead of Utility Manager.
2. Reset the target account's password:

net user AccountName NewPassword123

Replace AccountName with the exact local username (run net user alone first if you're not sure of the exact name) and choose a new password. You'll see The command completed successfully.

Step 5: Log In and Restore Utilman

Close the command prompt, log in with the new password, then undo the swap so the Ease of Access button works normally again and so this backdoor isn't left open. Open an elevated Command Prompt from inside Windows and run:

copy /y C:\Windows\System32\Utilman.exe.bak C:\Windows\System32\Utilman.exe

If the Account Is a Microsoft Account

The net user command only changes the local logon cache password for a Microsoft account, which can cause sync and OneDrive authentication issues afterward. For a Microsoft account, it's cleaner to reset the password online from another device at account.live.com/password/reset, then sign in with the new password — Windows will pick it up automatically on next login as long as you have network access at the login screen.

An Alternative Without Command-Line Editing

If you'd rather not manually swap system files, dedicated offline password reset tools like the free Offline NT Password & Registry Editor or built-in options in tools like Hiren's BootCD PE accomplish the same result — clearing or resetting the local account password by editing the SAM registry hive directly from a bootable environment — without leaving any files behind to restore afterward.