How to Crack / Reset a Windows password using MediCatUSB — step-by-step guide 🛠️

Emily Carter 26th October 2025 in Windows - 13 Minutes

If you’ve locked yourself out of a Windows account on a PC you own (or have explicit permission to fix), MediCatUSB lets you boot the machine from a flash drive and use offline tools to reset or remove local account passwords. This guide walks you through the full process I demonstrated in the transcript — why it works, what to prepare, and exactly what to click and expect. Read the disclaimer and caveats first.

Disclaimer / legal note (please read)
Only use the instructions below on computers you own or where you have explicit, written permission from the owner to perform recovery actions. Intentionally accessing or modifying someone else’s computer without permission is illegal in many jurisdictions. This guide describes legitimate recovery techniques for local Windows accounts (not Microsoft accounts or encrypted drives). If the target PC uses full-disk encryption (BitLocker) or an online Microsoft account, the techniques here may not work and could risk data loss.

1 Why this works — a short explanation

Before we jump into the button-clicking, let’s pause for a second and understand the principle. Windows stores local user account credentials (hashed passwords and account flags such as “locked” or “disabled”) in a system file called the SAM (Security Accounts Manager) database. When you boot Windows normally, that file is in use and protected. But if you boot the PC from an external environment — a live USB like MediCatUSB — you can access the file offline (because Windows is not running and locking it). Offline password tools can open the SAM, edit or blank password hashes, and flip account flags (unlock, enable). After you reboot normally, Windows sees the updated SAM and accepts the new or blank password.

That’s the foundation. The rest is about safe, correct steps so you don’t accidentally harm data or trigger other protections.

2 What you need (Hardware & Conditions)

Let’s list what to have before starting. Take a moment to collect these — it saves time later.

A USB flash drive prepared with MediCatUSB (the transcript uses an already-built MediCat live USB).
The target Windows PC (desktop or laptop) that you want to recover access to. You must be able to change its boot order or use its boot menu (Esc, F2, F12, etc., depending on model).
A keyboard (some laptops need an external keyboard for early boot keys).
Physical access to the machine — you’ll be turning it off, inserting/removing the USB drive, and rebooting.
Knowledge whether the locked account is a local account or a Microsoft account. (If it’s a Microsoft account tied to an email, offline reset methods will not change the online password — you’ll need Microsoft’s account recovery in that case.)
IMPORTANT: if the disk is encrypted with BitLocker you’ll need the recovery key; offline SAM editing alone will not decrypt the drive.

If any of the above is missing (for example, BitLocker enabled and no recovery key), stop and get the recovery key or owner permission — continuing can lead to data loss or permanent lockout.

3 Prep: Get a MediCatUSB flash drive ready

The transcript assumes you already have a MediCatUSB live environment on a flash drive. The live environment boots into a portable toolkit (like a Linux/Windows PE environment) and includes many password tools. If you already have that USB, great — we follow the same flow. If you don’t, prepare a MediCatUSB or similar rescue USB on another machine before attempting recovery.

A couple of practical prep steps (non-technical summary):

Verify the USB is bootable: plug it into another machine, force its boot menu and confirm the live environment starts.
Label your flash drive physically so you don’t confuse it with ordinary storage.
Have a separate storage backup available if your goal is primarily data rescue rather than password reset.

Wnat to know more how to create a MEDICAT USB refer to this link below:

Medicat USB (October 2025 Guide): The Ultimate PC Repair Toolkit with Hidden Features!

4 Booting the target PC from the MediCatUSB stick

Now for the hands-on part. The transcript gives a clear, chronological flow — I’ll turn that into a repeatable list with small extra notes.

Intro text before steps: take a breath and make sure the target PC is off. You’ll be changing hardware state; a calm, stepwise approach prevents accidental power interruptions.

Steps:

Power off the PC completely (shut down, not sleep).
Insert the MediCatUSB flash drive into an available USB port.
Power on the PC and immediately press the key for the boot menu repeatedly. On many ASUS laptops (as in the transcript) that key is Esc; on others it might be F12, F8, or F10 — check your model if you know it. If you don’t know, try Esc → F12 → F8 as soon as the machine powers up.
The boot menu will show available boot devices. Use the keyboard to choose the USB flash drive entry (it will often mention the drive brand or “USB device”). Select it and press Enter.
The machine will boot into the MediCat live environment (you’ll not be booting into Windows at this stage). Wait for the boot sequence to finish and for the MediCat desktop or menu to appear.

Notes:

If the machine boots straight to Windows instead of the USB, power off and re-enter the boot menu; sometimes timing matters.
If Secure Boot is enabled and blocks the USB, you may need to disable Secure Boot in the UEFI/BIOS temporarily (see section 9 on UEFI/Secure Boot caveats).

5 Finding and loading the offline password tools inside MediCatUSB

Once the live environment is up, you’ll have access to a collection of password tools. The transcript demonstrates a practical sequence:

Intro before the next list: think of this step as browsing a toolbox. The live stick contains several utilities — pick the one you’re comfortable with. If one fails, try another.

Typical flow (based on the transcript):

From the MediCat menu, navigate to the password / account recovery section (tools labelled with names like lockpick, NTPWEdit, Lazesoft, bypass-windows-password, etc.).
Select the tool you want to try. Many of these tools will automatically search the system disk(s) for the SAM file (the Windows account database). If the tool finds the SAM file, it lists all local accounts present on the machine (Administrator, guest, and any user accounts).

Important concept: these tools operate offline by accessing the SAM and SYSTEM registry hives directly from the Windows disk. That lets them change password hashes or clear the password field.

6 Two tested tools: NTPWEdit and Lazesoft — exact steps

I’ll provide step-by-step instructions for each, plus what to expect.

6.1 NTPWEdit (A Popular SAM Editor)

NTPWEdit is broadly used because it offers a direct view of Windows local accounts and allows you to set a new password or blank the password field. It’s simple and effective for local accounts on systems without extra encryption.

Steps (based on transcript + safe practice):

Launch NTPWEdit from the MediCat menu (sometimes the tool is invoked via the ntpwedit entry or through a menu item labelled similarly).
The tool will scan mounted partitions and find the Windows SAM file (commonly under C:\Windows\System32\config\SAM). If it finds the file, it will show the available accounts: Administrator, Guest, and user accounts (e.g., Monkey C, Jules, Vincent).
Select the account you want to modify (for example Monkey C).
Click Change password or the equivalent action. Enter the new password you want (the transcript sets monkeydo as an example). Consider using a temporary password you will change again immediately after logging in.
Hit OK or Save, and ensure the tool writes the change successfully. The tool will generally prompt that the SAM has been updated.
Exit the utility and close any open MediCat windows. Choose to shut down the live environment (do not hibernate).
Remove the MediCatUSB and reboot the machine normally into Windows (or just restart and let it boot to internal disk).
On the Windows login screen, type the new password you set and sign in.

Important notes:

If the tool reports an error locating the SAM or cannot write the file, check whether you selected the correct partition.
If the account is a Microsoft account (uses an email login), NTPWEdit cannot change the online password — it only affects local SAM accounts.

6.2 Lazesoft (Another Recovery tool)

Intro before steps: Lazesoft often provides a GUI that shows account lock status and lets you clear or blank passwords. The transcript shows it successfully clearing Vincent’s password.

Steps:

Launch Lazesoft from the MediCat menu. It will scan and detect the Windows installation and SAM file.
The interface lists accounts and may show indicators: locked/unlocked, password present or blank.
Choose the account you want to reset. Lazesoft often provides two options: bypass password or remove/blank password. Removing the password sets it to blank so you can sign in without entering anything; bypass can sometimes set temporary bypass tokens.
Execute the reset and wait for confirmation “reset successfully” (as the transcript showed).
Exit Lazesoft and shut down the live environment. Remove the USB and boot normally.
On the Windows login screen click the user (e.g., Vincent) and press Sign in — when the password field is blank, just press Enter.

Important follow-ups:

After you get back into the account, add a real password and review account security settings (see section 10).

7 After the change: rebooting and logging in

Intro before steps: this is the satisfying part — check that the edits wrote correctly and you can access the account cleanly.

Procedure:

Ensure you close all tools and choose shutdown from the live environment. Some utilities will prompt “remove flash drive before reboot” — follow their guidance.
Remove the MediCatUSB and power on the PC. Let it boot into the internal Windows installation.
On the Windows sign-in screen, select the account you changed (e.g., Monkey C) and enter the new password you set (or press Enter if you blanked the password).
If login is successful, immediately open User Accounts or Settings → Accounts and set a secure password and, if appropriate, enable password recovery options. If the account is local and you prefer it to remain local, consider adding security measures like a PIN or an offline password manager.

If login fails:

Double-check spelling and caps lock.
If still failing, reboot and try another tool from MediCatUSB — sometimes one tool writes differently or a different account flag was set. See troubleshooting next.

8 Troubleshooting & common hiccups

Let’s address the things that can go wrong and how to respond.

Tool can’t find the SAM file: Make sure you selected the correct disk/partition. Some machines have multiple drives (SSD + HDD) or the Windows partition may not be C: from the live environment perspective. Explore mounted partitions to locate Windows\System32\config\SAM.
Tool finds SAM but cannot write: The partition might be marked read-only. Try remounting as read/write if the environment supports it, or try a different tool.
Windows still requires previous password: If the account is a Microsoft account (online), changing the local SAM won’t change Microsoft’s servers. Use Microsoft account recovery or convert the account to local if you can access the Microsoft account email.
Account still locked or disabled: Some tools also change account flags (unlock/enable). Look for an option to toggle Account is disabled or Account is locked.
Automatic reboot / boot order changed: If you forget to remove the USB, the machine may boot back to MediCat. That’s harmless — just remove the USB and boot normally.
Live environment fails to boot: Try another USB port (use USB-2 vs USB-3) or rebuild the rescue USB and re-try.

If nothing works, stop and consider data recovery/uploading your drive to a safe location first instead of repeated destructive edits.

9 Important caveats: BitLocker, Microsoft accounts, UEFI/Secure Boot

Before you proceed in desperation, double-check these blockers:

BitLocker (full disk encryption): If the Windows drive is encrypted with BitLocker and you do not have the recovery key, offline SAM edits won’t help because the disk contents are encrypted at rest. You’ll need the BitLocker recovery key to mount or decrypt the drive.
Microsoft online accounts: If the Windows user is linked to a Microsoft account (email/password), the cloud password is authoritative. The local SAM may still have a cached credential, but changing the local SAM often won’t allow you to sign back in as that Microsoft account — you’ll need Microsoft’s account recovery.
UEFI / Secure Boot: Some modern PCs block unsigned boot media under Secure Boot. If MediCatUSB is blocked by Secure Boot, you may need to disable Secure Boot temporarily in the UEFI settings or sign the media (advanced). Be careful — changing UEFI settings can have consequences; if you’re unsure, ask an experienced friend or technician.
Hardware TPM interactions: Some devices use TPM to protect credentials; tampering with the SAM may trigger additional protections.

10 Best practices after recovery (security checklist)

Once you regain access, don’t leave the account insecure. Here’s a short checklist of sensible steps:

Immediately set a strong password (use a passphrase or long random password; avoid simple words like monkeydo).
Enable Windows Hello PIN or biometric login if available. PIN is tied to the device and is often easier and secure for local access.
If your account was local and you prefer it online, consider converting to a Microsoft account only if you want cloud recovery features — otherwise keep a local account but ensure a secure password.
Check BitLocker status. If it was disabled previously, consider enabling BitLocker after ensuring you have the recovery key stored safely.
Review Event Viewer and Security logs if you suspect unauthorized access.
If this machine is used in a corporate environment, report the recovery action to your IT department per policy.
Consider enabling a password manager and storing credentials there — it prevents future lockouts due to forgotten passwords.

11 Q&A — quick answers to common questions

Q: Is this method safe for my files?
A: When performed correctly, offline SAM editing only changes account authentication data. However, mistakes (or attempts on encrypted drives) can cause data loss. Back up the drive if possible before trying invasive tools.

Q: Will this work for Windows 10 / Windows 11?
A: Yes — the method targets the SAM database, which both versions use for local accounts. But make sure to check for BitLocker and Microsoft account caveats.

Q: What if my account is a Microsoft account (email-based)?
A: You’ll need to use Microsoft’s account recovery flow. Offline tools generally won’t change your cloud credentials.

Q: Is this considered hacking?
A: It’s a legitimate recovery technique when used on systems you own or have permission to fix. Unauthorized use is illegal.

Q: Can I use these tools to unlock a domain account?
A: No. Domain accounts are validated against the domain controller, not the local SAM. Local SAM edits won’t help domain credentials.

Q: Do I need to try multiple tools?
A: If one tool fails, try another. MediCatUSB includes several utilities because different machines/configurations respond better to different tools.

12 Final checklist and closing notes

Before you attempt this, run through the short checklist:

Do you own the PC or have explicit permission?
Is the drive unencrypted (or do you have the BitLocker key)?
Do you have a MediCatUSB (or equivalent) live USB ready and tested?
Do you know the boot menu key for your machine?
Do you have a plan to secure the account immediately after recovery (strong password, Windows Hello, etc.)?

Closing note: Getting locked out is stressful but recoverable in many cases. The transcript’s live demo shows how clean and fast the process can be when you have physical access and the right tools. The key principles are simple: boot from a trusted rescue USB, access the SAM offline, use a reputable tool (like NTPWEdit or Lazesoft) to change or blank the password, and then reboot into Windows and secure the account.

#WindowsHelp #PasswordReset #MediCatUSB #DataRecovery #Cybersecurity #DIYTech #WindowsTips

Visited 18 times, 1 visit(s) today

Emily Carter

Emily is a Windows power user and technical writer from the UK. She has spent 7+ years in IT consulting, helping businesses migrate to new Windows versions, optimize performance, and solve common errors. Emily’s articles combine professional experience with step-by-step clarity, making even registry hacks accessible to everyday users.

Website · More from this author