Kid bypassing Laptop Windows Password

OspreyO · 25 Apr 2023 at 21:23

Ok one of the Kids is bypassing the the laptop (w11) password.
Two accounts on the laptop mine and theirs. Both with random passwords that can't be guessed. Kid still Managed to get on it.
Now I'm wondering has he a keylogger on it. Nothing in the USB ports. Could he have something on it that exists before Windows Loads.

I'm going to wipe the machine and put linux on it. Leave him with no account on it. But I'm curious how he's getting on it.

OspreyO · 25 Apr 2023 at 21:44

It's only used for his games. He has previous form, of this, so he is on his own machine.

OspreyO · 25 Apr 2023 at 21:49

adidan said:
Clever kid, you should be proud.

I presume they don't have an admin level account?

He's dumb because I'll take it off him completely.

His account is admin. But I changed the password. I'm asking for ideas how he got around the password.

OspreyO · 25 Apr 2023 at 22:34

I'll have to check both pin and offline password editor. Thanks.

How would you block them though.

OspreyO · 26 Apr 2023 at 09:20

Murphy said:
IIRC booting into safe mode automatically logs you in using the local admin account so it's possible they've worked around the password from there.

e: Just checked and apparently you can check if previous startups where normal or safe mode by checking event viewer system log for events with an ID of 12 and checking the details tab for an entry called BootMode, 0 is normal, 1 will be a safe mode boot.

Thanks. I'll check that.

OspreyO · 26 Apr 2023 at 11:14

SexyGreyFox said:
Have you asked him?

Of course. But he has never told be how he's done any of his hacks over the years.

OspreyO · 26 Apr 2023 at 11:15

darael said:
OP right now:

Lol when I said Kid hes taller and stronger than I am. But I'm a dirty fighter and he isn't.

OspreyO · 26 Apr 2023 at 11:16

DavidTJ said:
How did you set the random password that can't be guessed, and remember it each time?

For instance could he have managed to guess the password to your password manager, or found where you write down passwords?

I used a long phrase he won't know.

Something like Utteruselessbasketgogetajobyouwasteofspace

OspreyO · 26 Apr 2023 at 11:20

john_smith said:
Is your password still the same as what it was, or has he changed it?

No idea, he's hidden the laptop...again.

OspreyO · 26 Apr 2023 at 11:29

john_smith said:
Hold old is he? This is a parenting issue, not an IT issue

Well I asked specially asked about the IT issues as I didn't want to derail it with some uninformed conversion about parenting.

OspreyO · 26 Apr 2023 at 12:08

andshrew said:
If the account you've created for them on the PC is an administrator then there are any number of things they could be doing. You cannot give someone that you do not trust admin rights and then be surprised when they do things you don't understand.

If you don't want them using the laptop BitLocker encrypt it, require a PIN to start up and don't create a user account for them.

That how my other equipment is set up, encrypted.

I suspect just taking the device away will be the solution. He'll be left with bad old laptop for school.

OspreyO · 26 Apr 2023 at 13:17

Quartz said:
There you go.

Precisely.

How is it precisely. if didn't have the password the account?

If he's using a USB stick to registry hack then its irreverent what the account is. he could make it anything he likes.

OspreyO · 26 Apr 2023 at 13:20

GaryTheSnail said:
By changing the password maybe?

You'll have to explain how your comment explains how he logged to change the password. He didn't have the password to login.

OspreyO · 26 Apr 2023 at 14:58

GaryTheSnail said:
By been logged in, in the first place. You asking a question nobody can probably answer on here.

How is people supposed to know how they got in?

Every one is just guessing.

You need to ask them.

john_smith said:
Has he changed your password? You don't know because he has taken away and hidden your laptop. He's an admin so he can change your password whenever he wants.

How old is he?

This isn't an IT issue.

I'm obviously not explaining this simply enough. I changed ALL the passwords.

So how does he log into his account (or any account) if he doesn't have the password. (for any of the accounts on the machine)

OspreyO · 26 Apr 2023 at 15:01

throwaway4372 said:
He has physical access. That trumps passwords.

Yes but HOW

Some have made some practical suggestions like a USB key.

OspreyO · 26 Apr 2023 at 15:03

john_smith said:
Has he changed your password? You don't know because he has taken away and hidden your laptop. He's an admin so he can change your password whenever he wants.

How old is he?

This isn't an IT issue.

I'm only asking about the IT issue.

OspreyO · 26 Apr 2023 at 15:06

GaryTheSnail said:
Are you trying to bypass systems somewhere? and your asking how it's generally done?

Like I said... nobody here knows how they are doing it.

I'm only looking for avenues to investigate.

For example someone suggested checking the event log and see if the event is recorded.

OspreyO · 26 Apr 2023 at 15:09

Vince said:
Check in the machines logs... Thats kinda what they are there for!

ID 4724 - Password reset attemot by admin and event ID 4723 is a password change attempt by a user

Cheers. Another one I will check.

OspreyO · 26 Apr 2023 at 15:09

GaryTheSnail said:
You are doing it wrong.

You are replying wrong.

OspreyO · 26 Apr 2023 at 15:24

john_smith said:
It's only an IT issue if you've got a laptop to have an issue with. You've not because your kid has taken your laptop away from you.

How old is he?

Not following this are you. I don't use the laptop. Its "his "laptop". Though obviously its my infrastructure to manage and police.