>AFAIK, this cannot be done with any tools. Wouldn't it be illeagal?
>

I have one tool in my arsenal that I use in extreme emergencies to edit damaged ACLs, fix passwords and the like when an NT system bites the big one - ERD Commander Professional. It requires physical access to the NT system, and the ability to take down NT. ERD Commander creates a set of boot disks that will boot a modified version of NT to a command console; it has tools to attach and edit a Registry, and will allow you to change a password for an account. It's not freeware, or even cheap - around $500 for the utility package as I recall, and you need to have an idea of how NT operates to use it, but it works on both FAT and NTFS volumes. It's sold by Winternals Software LLC (www.winternals.com); I'm sure you're aware of them, but for other people who're in the position of supporting NT installations for a living, they probably make the premiere NT maintenance products. I wouldn't be fully capable of doing my job without ERD Commander Professional, NT Recover, NTFSDOS Tools and Blue Save.

To a more limited extent, you can use a second NT system to get at a box that starts up but can't be logged into as long as you've prepared for it in advance. NT Recover can get at drives through a serial connection to another NT system; I use it to get myself to a point where I can get CHKDSK to run on a damaged volume that won't allow me to log in, but NT starts up to some extent. There's a further add-on that, once you've made the necessary repairs using NT Recover, is sometimes successful at resetting the admin password for an NT box with a damage boot partitiion.

These are not end-user tools designed to allow you to rape and pillage an NT system; I normally break them out when I get to a situation where I can't bring up an NT box after a bad crash. They're administrator recovery tools, not something that you load up to crack security on an NT system.

>>If you have rights as a Domain Administrator, but the Domain Administrator group does not have Local Administrator rights on the workstation, you may not be able to change the local Administrator password directly using standard NT tools.