Kid bypassing Laptop Windows Password

[OspreyO]

Ok one of the Kids is bypassing the the laptop (w11) password.
Two accounts on the laptop mine and theirs. Both with random passwords that can't be guessed. Kid still Managed to get on it.
Now I'm wondering has he a keylogger on it. Nothing in the USB ports. Could he have something on it that exists before Windows Loads.

I'm going to wipe the machine and put linux on it. Leave him with no account on it. But I'm curious how he's getting on it.

 

[adidan]

Clever kid, you should be proud.

I presume they don't have an admin level account?

 

[montymint]

If you use the laptop for anything secure, I'd be asking him outright.

If he's installed a keylogger, unless he's written it himself there's a good chance details have been scraped.

 

[OspreyO]

It's only used for his games. He has previous form, of this, so he is on his own machine.

 

[OspreyO]

Clever kid, you should be proud.

I presume they don't have an admin level account?

He's dumb because I'll take it off him completely.

His account is admin. But I changed the password. I'm asking for ideas how he got around the password.

 

[Semple]

Most likely he's also set the account up with a pin. If you have an admin account I believe you should easily be able to see.

 

[drakulton]

He's dumb because I'll take it off him completely.

His account is admin. But I changed the password. I'm asking for ideas how he got around the password.

Offline NT Password & Registry Editor​

 

[OspreyO]

I'll have to check both pin and offline password editor. Thanks.

How would you block them though.

 

[Murphy]

IIRC booting into safe mode automatically logs you in using the local admin account so it's possible they've worked around the password from there.

e: Just checked and apparently you can check if previous startups where normal or safe mode by checking event viewer system log for events with an ID of 12 and checking the details tab for an entry called BootMode, 0 is normal, 1 will be a safe mode boot.

 

[drakulton]

I'll have to check both pin and offline password editor. Thanks.

How would you block them though.

I imagine trying to type with broken fingers would be really difficult.

 

[OspreyO]

IIRC booting into safe mode automatically logs you in using the local admin account so it's possible they've worked around the password from there.

e: Just checked and apparently you can check if previous startups where normal or safe mode by checking event viewer system log for events with an ID of 12 and checking the details tab for an entry called BootMode, 0 is normal, 1 will be a safe mode boot.

Thanks. I'll check that.

 

[SexyGreyFox]

Have you asked him?

 

[darael]

OP right now:

 

[DavidTJ]

How did you set the random password that can't be guessed, and remember it each time?

For instance could he have managed to guess the password to your password manager, or found where you write down passwords?

 

[OspreyO]

Have you asked him?

Of course. But he has never told be how he's done any of his hacks over the years.

 

[OspreyO]

OP right now:

Lol when I said Kid hes taller and stronger than I am. But I'm a dirty fighter and he isn't.

 

[SexyGreyFox]

Of course. But he has never told be how he's done any of his hacks over the years.

Aaaaaahhhhhh or

 

[OspreyO]

How did you set the random password that can't be guessed, and remember it each time?

For instance could he have managed to guess the password to your password manager, or found where you write down passwords?

I used a long phrase he won't know.

Something like Utteruselessbasketgogetajobyouwasteofspace

 

[john_smith]

Is your password still the same as what it was, or has he changed it?

 

[OspreyO]

Is your password still the same as what it was, or has he changed it?

No idea, he's hidden the laptop...again.