Q: How can I change the password of a domain controller’s (DC's) Directory Services Restore Mode (DSRM) and Recovery Console administrator account?
A: First, let me explain the differences between AD’s DSRM and Recovery Console. Both are Windows disaster-recovery tools. DSRM is available only on Windows DCs and enables a server operator to restore the Active Directory (AD) from a backup copy. To get into DSRM, you must press and hold the F8 key when your system starts. When you do so, Windows will prompt you for a password (i.e., the DSRM administrator account’s password) and then start the machine in an administrative context that will let you repair AD from the command line. DSRM is commonly used for an authoritative restore of the AD database, which can be started using the ntdsutil command-line tool. You can use authoritative restore to restore accidentally deleted objects in your AD database.
Unlike DSRM, the Recovery Console isn't available from the Windows boot menu and can be used on non-DC Windows machines. Similar to DSRM, it provides a command-line interface from which you can initiate repair and recovery actions. The Recovery Console is available as an option when you run the Windows Setup CD. When Setup runs, it checks to see whether there's already a copy of Windows on the machine. If there is, Setup asks you whether you want to try to repair the existing copy or simply install a fresh copy. If you select Repair, Windows prompts for the Recovery Console’s administrator password and then enters the Recovery Console.
Microsoft didn't include the Recovery Console in Windows Server 2008 and Windows Vista. Instead, Server 2008 and Vista include the System Recovery Options menu that provides both disaster recovery and system-diagnostics features. You can access it by using the Repair your computer option that displays when you boot your system from a Server 2008 or Vista installation CD. For more information about the Systems Recovery Options menu, go to http://windowshelp.microsoft.com/Windows/en-US/Help/326b756b-1601-435e-99d0-1585439470351033.mspx.
On a Windows DC, DSRM and the Recovery Console leverage the same administrator account and password for controlling access to their troubleshooting and repair features. Administrators set a DC’s DSRM and Recovery Console administrator password during the dcpromo process (i.e., when they're promoting a Windows server to an AD DC). The DSRM and Recovery Console administrator account is stored in the registry-based Security Accounts Manager (SAM) database of the local DC. The SAM is located in the %SystemRoot%\System32\Config folder. The DSRM and Recovery Console administrator account and password are computer-specific and aren't replicated to other DCs in a domain.
In Windows 2000, you can reset the DSRM and Recovery Console’s administrator password using the setpwd.exe command-line tool that's included in Win2K SP2. In Server 2008 and Windows Server 2003, you must use the ntdsutil.exe command-line tool to reset the DSRM and Recovery Console’s administrator password. To do so, start ntdsutil by typing ntdsutil at the command line, type set dsrm password (or in short format set d p), and then type reset password on server %servername%. (Note that you must replace %servername% with the name of the DC on which you want to reset the password.) Next, enter the new password, type q to quit the dsrm command, and type q to quit ntdsutil.