Sometimes things happen and a password gets forgotten or lost, or in the worst case it wasn’t updated in your password management tool after it was changed. We’ve likely all had to bug another admin to reset our password for one system or another. It happens. But what happens if you are the lone Domain Admin and lock yourself out? Luckily, there is a way to get back in if you do get locked out.

• Download the Windows Server 2016 ISO.
• Attach the ISO to your DC virtual machine.
• Reboot the VM into the ISO
• Select: Repair your Computer -> Troubleshoot -> Command Prompt
• At the command prompt, run the following commands:

cd c:\Windows\System32
ren osk.exe osk.old
copy c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe osk.exe

• Reboot the Server.
• Launch the on-screen keyboard and PowerShell will open
• At the Powershell prompt, run the following command, replacing <PASSWORD> with the password of your choice:

Net user Administrator <PASSWORD>

• Revert file changes in your System32 folder, renaming ‘osk.old’ back to ‘osk.exe’.

And there you have it folks, you are now able to log back in with your Domain Admin account. This works because while the DC does not have a local Administrator account, it somehow realizes that and resets the Domain Admin. Yes it is a little bit of black magic fuckery in that regard… But it worked and got you back in, so who are we to complain.