A version of PassPass is included in the E2B docs folder.
It works by patching some code bytes in the Windows DLL file which handles user authorisation at logon.
How to use PassPass
1. (optional) If possible, boot to WinPE or linux from a USB drive and make backup copies of:
\Windows\System32\NtlmShared.dll (if Windows 10/Server 2016)
This is so that if you break Windows by patching these dlls, you can restore them again, if necessary.
2. Boot from the E2B USB drive and run PassPass and choose the Windows installation you want to patch
3. Use the Backup option to keep a copy of the DLL. Note: make a note of what volume and DLL this is, in case you need to restore it later.
4. Use the Patch option to patch the DLL
5. Boot from the HDD to Windows, create a new Admin user account, log in to the new account (for normal behaviour), do what you want (e.g. reset passwords), delete the new user account.
6. Boot from the E2B USB drive and run PassPass, select the same Windows OS again and use UnPatch to restore the original DLL (or you can use the Restore DLL option if you previously made a backup - make sure that you restore the same DLL and volume that you backed up in Step 3).
If anything goes wrong, restore the DLL file copies that you made in Step 1 using WinPE (or linux).
How to add PassPass to your E2B USB drive
Simply copy the \_ISO\docs\PassPass folder to the \_ISO\UTILITIES folder.
You should now have a \_ISO\UTILITIES\PassPass folder present containing PPass.g4b, PassPass.bak and PassPass.mnu.
You can now patch the Windows DLL on any volume in the system. The user password for any Windows local account will then not be required.
Note: You may be warned that more than one patch location exists. This is normal for some DLLs (e.g. Windows 8).
If you have any problems, please report them to me (the OS version number and MD5 hash is required as well as the OS name, filename and 32/64-bitness).