Replacing Utilman to Get Back Into a Locked Windows 10 Machine
Here is how the Utilman trick actually works in practice. When you boot from a Windows installation media, you get access to a command prompt before the OS fully loads. That prompt runs with system-level privileges. From there, you can swap out the utility manager executable — Utilman.exe, the accessibility button program — with a copy of cmd.exe. Once that swap is done, you reboot back into Windows. Instead of the little accessibility icon doing its normal thing, it opens a command prompt. You use that prompt to create a new local admin account or reset the password on the locked account. It is straightforward. It is also one of those methods that sounds more complicated than it actually is until you try it on a machine with encryption or weird partition layouts. You need a Windows 10 ISO or installation USB. If you do not have one, download it from Microsoft and use a tool like Rufus to write it to a USB drive. Boot the locked computer from that USB. Hold Shift while clicking Restart on the login screen, or force it into the recovery environment by interrupting the boot process three times in a row. Once you are in the blue recovery menu, navigate to Troubleshoot, Advanced Options, Command Prompt. The drive letters in the recovery environment are not always the same as they are in the running OS. The C drive might show up as D or E. Run diskpart, then list volume to figure out which partition has your Windows installation. You should see the main Windows folder structure on one of the volumes.
Once you identify the correct drive letter — let us say it is D — run these commands in sequence: copy D:\Windows\System32\utilman.exe D:\utilman.exe.bak This backs up the original file. Do not skip this step. Then run:
copy D:\Windows\System32\cmd.exe D:\Windows\System32\utilman.exe /Y The /Y flag suppresses the overwrite confirmation prompt. Now restart the computer and remove the USB drive. When you reach the login screen, click the accessibility icon in the bottom right corner. A command prompt opens with SYSTEM-level privileges. From here you can reset a password: net user Administrator NewPassword123
Get the Full Details
Or create a new local admin account: net user backdoor MyPass456 /add net localgroup administrators backdoor /add
Log in with the new credentials and you are back in. I ran into a situation last year where this method failed on a corporate laptop because BitLocker was enabled and the recovery environment could not access the system partition without the recovery key. The copy commands simply returned an access denied error. The workaround was to enter the BitLocker recovery key at the recovery prompt, which unlocked the volume and allowed the command prompt to proceed normally. Without that key, the entire approach was dead on arrival. Another thing most guides do not mention is that Windows Update can restore the original utilman.exe after a few days. If you are relying on this method on a machine that stays connected to the internet, the replacement gets reverted automatically. To prevent that, you would need to set proper permissions on the replaced file or disable the Windows Update service from the command prompt before rebooting into the OS.
The method only works on local accounts. If the locked account is tied to a Microsoft account, resetting the local password gives you access to that local profile but does not change anything about the Microsoft account credentials. You would still need to log into the Microsoft account portal from another device to reset that password separately. There are also newer versions of Windows 10 where the accessibility icon is replaced or removed entirely from the login screen. On some enterprise builds, the Utilman replacement simply does nothing when clicked because the login screen UI was modified. In those cases, this approach is not going to work and you would need to look at alternative methods like using offline password modification tools or booting into Safe Mode with Command Prompt support. After you regain access, remember to replace utilman.exe with the original backup file you saved earlier. Leave the replacement in place and you are essentially leaving a backdoor on the machine. Copy the backup back over, or just delete the modified file if you do not plan to use the trick again.
