NOTE: Only for local accounts. Does not work for domain joined accounts.

Step 1 – Set Up #

Firstly, boot to the installation media

Click ‘Next’ -> ‘Repair your computer’ -> Select your OS -> ‘Command Prompt’

Enter main partition. Can be check by typing the command
notepad -> clicking ‘Save As’ -> browse to ‘This PC’ -> and see
what drive letter is for the main drive

Type the following commands to access the system32 folder

C:

cd Windows/System32

Create a backup of the Utilman.exe program

copy Utilman.exe Utilman.bak

Replace Utilman.exe by cmd.exe

copy cmd.exe Utilman.exe

Type ‘y’ to accept

Step 2 – Creating/Editing User #

Restart the computer to access the windows login menu.

At the login menu press WINDOWS+U on the keyboard to launch the disguised Utilman application

To change a password:

net user "username" "newPassword"

Create a new local admin:

net user "newUser" "password" /add
net localgroup Administrators "newUser" /add

Activate the default local admin and change the password:

net user administrator /active:yes
net user administrator "newPassword"

Step 3 – Cleanup #

Follow instructions from Step 1 to access the command prompt

C:

cd Windows/System32

We now need to remove the cmd disguised Utilman:

del Utilman.exe

And then rename the backup Utilman to restore the original exe

ren Utilman.bak Utilman.exe