How to change the password of a local user of a domain PC without privileges and with the option to prevent password changes enabled?

Question

System administration

Hello. There is a domain PC on windows 10 Pro_x64 with disabled built-in admin and guest accounts. It has a local user account in the "users" group. She was given a password and set the prohibition of changing the password by the user. The PC has access to the Internet and does not have access to the domain network. USB are open, the antivirus is a homemade Casper (that is, it seems to be non-existent).
After some time, it turns out that the user's password has been changed and the option to prevent password changes is disabled.
How and with what can you reset the user's password under the described conditions? I understand that if there is access to USB, then all the tricks are useless, but I would like live examples of software or other recipes - you need to reproduce.
Right now there is no way to connect to it, read the logs and merge the image. Thanks

Answer 1

The liveliest example of resetting the password of any local account with the possibility of booting from third-party media is Hiren's Boot CD. Boot from the media, edit the password (there is such a program there), then boot from the disk. There will be nothing in the logs, except for the fact of two reboots.

Answer 2

Enough disk access.
For example, you can load any LiveCD (including the Windows installation disk), swap in %WINDIR%\System32sethc.exe and cmd.exe, quickly press Shift 5 times on the login screen - cmd.exe will appear with NT\SYSTEM rights

Answer 3

1 - if you can't access your computer - you're not a domain admin
2 - if it's purely "local" - MSDaRT (+ Google) to help. but it is impossible to change the options of the domain user from the local area (without the help of the domain admin)
3 - in almost all versions of Windows, there are hacks that allow you to log in under the system , but this is again a local account - it will allow you to reanimate the mummy of the local admin without "dart", but intervene she still cannot enter the domain