Last Updated on May 8, 2026
As you probably know, to log onto a computer running Microsoft Windows, you need a user account with a password. You can also use a PIN, fingerprint reader or other biometric device if you do not want to use a password. And as long as you don’t forget your password, everything should be fine. But you may run into a situation where your password or PIN no longer works, or Windows itself has a critical issue that prevents you from logging on to your computer.
If you happen to have another active user account on the PC, you can generally use that secondary account to log on to your computer and try and fix your other account. But if the locked profile is the only account you have on your computer, then you have a serious problem. In this article, we will be showing you exactly how to enable and log in with the built-in Windows admin account if you can’t log on to your computer.
How the Accessibility Shortcut Hack Works
This backdoor method is often referred to in the IT world as the “Utilman Hack.” Utilman (Utility Manager) is the official Windows process responsible for launching the accessibility options on your login screen. By using the Command Prompt in the recovery environment to temporarily replace the Utilman executable with the Command Prompt executable, we can effectively “trick” Windows into giving us an administrative command line before anyone even logs in.
Once we have that powerful command line access sitting right at the login screen, we can securely launch the Registry Editor or use “Net User” commands to unlock the hidden Administrator account. This gives you a safe back-door entry into your operating system to recover your files and fix your primary account without needing third-party software.
On a side note, Windows comes preconfigured with an administrator account that is simply named Administrator, but it is disabled by default for security purposes. If you want to use this account on your computer even when you are not having issues, you can easily enable it via the command line when run as an administrator.
To successfully enable the built-in Administrator account, you would type: net user administrator /active:yes
To safely disable the built-in Administrator account, you would type: net user administrator /active:no
1. Force the System to Shut Down
If your computer is completely frozen or the standard “Shift + Restart” method doesn’t work, you can force Windows into the Windows Recovery Environment (WinRE). To begin this process, you first need to turn your computer completely off by holding the physical power button until the screen goes black.
2. Interrupt the Boot Process Repeatedly
Turn the computer back on, and as soon as you see the Windows logo or the manufacturer logo (Dell, HP, Lenovo, etc.), hold the power button down again until it shuts off. You are intentionally interrupting the boot sequence to trigger a system failsafe. You will need to repeat this exact hard-shutdown process 3 times in a row.
3. Trigger the Automatic Repair Screen
On the fourth start, let the computer boot up normally without pressing the power button. Windows will detect the previous failed boots, display a message saying “Preparing Automatic Repair,” and then give you the “Advanced Options” button to safely reach the Troubleshoot menu.
4. Boot Windows Into the Recovery Options
If you actually have access to the login screen and your mouse works, the first step in enabling the built-in Windows admin account is much easier. It simply requires you to hold down the Shift key on your keyboard while clicking on the Restart option from the power menu at the lower right corner of the login screen.
5. Choose the Troubleshoot Option
Using the Shift key method will instantly boot Windows directly into the recovery options interface. This blue menu has a wide variety of tools you can use to try and repair your computer if it is not starting properly or having other issues. On this very first screen, you will need to click on the Troubleshoot option to proceed.
6. Access the Advanced Options
After clicking on Troubleshoot, you will be presented with a choice to either Reset the PC or dig deeper into the system tools. Because we need to run specific commands, you will need to click on the Advanced options button. This will reveal the technical utilities needed for the Utilman hack.
7. Open the Recovery Command Prompt
In the Advanced options section, look through the grid of available tools for the command line icon. You will need to click on Command Prompt, which will open a black terminal window with full administrative privileges over your offline operating system.
8. Understand Your Windows Drive Letter
Once you are at the command line, you will need to find out exactly which drive letter is being used for your Windows installation. By default, Windows WinRE will use the temporary drive letter X at the prompt, but for most live systems, Windows uses the letter C for the main drive. If you blindly try to run the required commands using the drive letter C, they may fail if Windows is currently assigned to a different letter in the recovery environment.
9. Run the DiskPart Command
If you have more than one volume or hard drive in your computer, there is an even greater chance that the letter C is not being used for the Windows drive, so you will need to find out which letter is actually active. To find the correct drive letter needed for the next step, you can simply type diskpart at the command prompt and hit enter.
10. Identify the Correct Volume
Once the prompt changes to say DISKPART>, you can type list volume and hit enter to show exactly what letters are currently assigned to what partitions and drives. You may see a lot of volumes, so you will need to know which one is specifically for Windows. It may have a volume label, but if not, you can also look at the Size column and find the one that matches the gigabyte size of your primary Windows drive.
11. Replace Utilman with the Command Prompt
Once you have identified the correct drive letter (we will use C: for this example), you will need to type the following exact commands. Be sure to replace the letter C with the letter of your Windows drive if needed, and confidently press enter after typing in each command.
move c:\windows\system32\utilman.exe c:\
copy c:\windows\system32\cmd.exe c:\windows\system32\utilman.exe
exit
12. Exit the Prompt and Continue to Windows
Once you type exit and leave the command prompt, you will be taken right back to the blue Windows recovery menu. From here, you will then carefully choose the “Continue, Exit and continue to Windows” option. Your computer will then reboot and take you to your normal, locked login screen.
13. Understand the SAM Hive Modification
The SAM (Security Accounts Manager) is a highly protected database file that securely stores user passwords and account permissions. Normally, this critical file is strictly locked by the system while Windows is actively running to prevent tampering. By using our newly created “Utilman” Command Prompt trick, we can bypass these restrictions and access the SAM hive directly from the login screen.
14. Trigger the Accessibility Shortcut Hack
Once you are back at the standard login screen, you will need to click on the Accessibility icon located to the left of the power icon in the bottom right corner. Normally, this would open visual and audio aids, but because of our previous commands, it will now launch a system-level command prompt window.
15. Open the Windows Registry Editor
This will successfully bring up a black command prompt window hovering right over your login screen. Because this terminal has system-level permissions, you will simply need to type in regedit and press enter to securely open the Windows Registry Editor.
16. Navigate to the Correct Registry Key
From inside the Registry Editor, you need to carefully navigate through the folder tree to find the specific entry controlling the built-in administrator account. You need to expand the folders to navigate exactly to the following key path:
HKEY_LOCAL_MACHINE\SAM\Domains\Account\Users\000001F4
17. Locate and Open the F Value
The specific key folder we are looking for, 000001F4, is the unique ID assigned to the built-in Administrator account. Once you click on that folder, look in the right pane for the binary entry labeled with the letter F. Double-click on the F value to open the binary data editing window.
18. Position Your Cursor on Line 0038
Modifying the binary data at offset 0038 is the manual way of toggling the “Account is Disabled” flag from “Yes” to “No.” Using the down arrow key on your keyboard, carefully place the blinking cursor on the line labeled 0038, directly before the number 11.
19. Change the Binary Value to 10
Once your cursor is in the correct position, press the delete key exactly one time to delete the number 11 from the sequence. Then, simply type the number 1 which will instantly insert the number 10 into that exact same slot. This flips the internal switch to enable the account.
20. Save Changes and Restart Your Computer
Click on the OK button to save the binary edit, and then go ahead and close out of both the Registry Editor and the black command prompt window. Once you are looking at the normal login screen again, click the power button icon in the corner and choose the Shut down option.
21. Log In With the Administrator Account
Turn on your computer again and wait for the operating system to load. At the sign-in screen, you should now prominently see the Administrator account listed alongside your other profiles. Simply click on the Administrator account to instantly log in to the desktop with no password required.
22. Boot Back Into the Recovery Command Prompt
Once you have successfully regained access to your computer and fixed your main account, you absolutely must undo the changes made to the utilman.exe file. If you don’t, anyone with physical access to your PC can click the accessibility icon and have full command prompt access to all your private files. To begin the cleanup, boot back into the Command Prompt via the Recovery Options (Shift + Restart).
23. Restore the Original Utilman Executable
Once the recovery terminal is open, you need to move the original accessibility program back to its rightful folder. Type the following exact command to move your original backup back into place: copy c:\utilman.exe c:\windows\system32\utilman.exe
24. Secure Your Computer and Restart
After pressing enter, the system will warn you that the file already exists and ask if you want to overwrite it. Type the word Yes to overwrite the modified file, then type exit to close the terminal, and restart your computer normally. This fully restores your accessibility options and tightly secures your computer’s login screen once again.
Windows Administrator Account FAQ
Why do I get an “Access Denied” error in Command Prompt?
This frustrating error usually happens if your hard drive is currently encrypted with Microsoft BitLocker. You will need to locate and enter your lengthy BitLocker recovery key before the Windows Recovery Environment will allow you to modify the secure System32 folder.
Will this work on Windows 10 and Windows 11?
Yes, this exact workaround applies to both modern operating systems. The specific location of the Utilman file and the SAM registry keys are completely identical in both Windows 10 and Windows 11 environments.
Can I use this method to reset a PIN?
Indirectly, yes you can. Once you successfully log in with the built-in Administrator account, you can easily go to Settings, navigate to Accounts, and securely remove or reset the PIN for your primary user account from there.
You can also use the Hirens Boot CD method to enable the Administrator account as an alternative option.
For additional training resources, check out our online IT training courses.
Check out our extensive IT book series.
