recovering Agilent 16903A from locked windows password? - Page 1
Forum section: electronics / testgear

author: wwmartin
author_rank: Newbie
timestamp: December 17, 2021, 03:55:24 am
content: Hi Everyone,Just brought home said 16903A from an auction, looks good right up till it wants a password to log in to Windows...Some clever soul left it locked when it went to auction! First question, what data should I scrape from the bios startup/post in order to get good responses to further questions here? It appears to be an XP "3" system for OS, I downloaded the Agilent software .iso today, but not sure if I can just wipe the OS & re-install the .iso, or will I lose important stuff, like is the Windows tweaked for this particular hardware or is that all self contained in the .iso? It looks like the hard drive would have to be pulled out in order to do a backup, so I'm a bit nervous about what I can do without doing that! Any help/advice/cookbooks appreciated.Best Regards,Bill Martinretired HP engineer (spelled correctly!)

author: Bud
author_rank: Super Contributor
timestamp: December 17, 2021, 06:20:44 am
content: Have you tried "password" and "12345..." ?

author: DaJMasta
author_rank: Super Contributor
timestamp: December 17, 2021, 06:59:46 am
content: If I remember right, there's a third party application available that will let you remote Windows XP passwords. Would have to do some googling, but I think I've opened up a instrument's PC portion that way before.If that's not there, or you don't want to, a reinstall and installation of the firmware package should also get it back on its feet. You may need some motherboard drivers or similar, but I think the firmware package is sufficient to get the system running as the option keys are held in hardware. To be safe, making an image of the drive before a reinstall is usually a good idea.

author: Zoli
author_rank: Frequent Contributor
timestamp: December 17, 2021, 07:19:50 am
content: I was using ERD Commander(meantime bought by µ$oft) to change the password on XP systems(the archive is 100MB, too big to post here).The utility name was "Password locksmith" - it maybe help.

author: wwmartin
author_rank: Newbie
timestamp: December 17, 2021, 05:16:37 pm
content: It should be so easy... :-) , but no, it isn't that easy. Just for grins I hooked it up to my router and found it did make a dhcp transaction, so I tried a "ping" to the local IP address and that works. It refused a telnet connection on that IP though, so no remote login by that route. There is also no web server at that IP address. I only fiddled with this to see if I might be able to do a disk image dump over my local network, but it isn't looking promising. Any other ideas to try before opening up the box?Thanks,Bill

author: Bud
author_rank: Super Contributor
timestamp: December 17, 2021, 05:28:26 pm
content: Try remote desktop RDP connection, it is using a different port, can't remember which one... but you should not be required to specify it.

author: jemotrain
author_rank: Contributor
timestamp: December 17, 2021, 05:56:56 pm
content: You can use a bootable CD with the "Offline Windows Password & Registry Editor"https://pogostick.net/~pnh/ntpasswd/

author: Whales
author_rank: Super Contributor
timestamp: December 17, 2021, 06:12:31 pm
content: "Ntpassword" above is the option that I've used before. If you can't boot the scope off external media then remove the HDD and plug it into another computer.

author: gslick
author_rank: Frequent Contributor
timestamp: December 17, 2021, 06:42:04 pm
content: Quote from: wwmartin on December 17, 2021, 03:55:24 amWhat software ISO image did you download? The "Logic and Protocol Analyzer CD ISO Image (Version 05.90.1104)" ISO image?That is just the logic analyzer application software. There are also system recovery CD ISO images. When you boot from those it will wipe the hard drive clean and install a Windows XP system image from a Ghost image. That Windows XP system image will already be activated, and all of the necessary drivers that are specific to the motherboard and video controller will already be installed.The logic analyzer application will not be installed by the system recovery CD, that can be installed later from the separate logic analyzer application CD. During the installation of the logic analyzer application, it will update if necessary the bitstreams of the FPGAs on the boards that interface between the motherboard and the logic analyzer module slots.If I remember correctly, the version of the Windows XP system image restored by the recovery CD ISO images is XP SP2. After restoring the system image the XP SP3 update should be installed first before installing the logic analyzer application. I would not bother trying to install any other updates to the Windows XP system. If you are concerned about network security, only connect the system to an isolated network.There were three motherboard versions used in the 16903A, all 1GHz PIII with 512MB. No real functional difference between them. There were different system recovery CD images for each motherboard version. The table below has the part numbers of the recovery CD images specific to each analyzer and motherboard version. For the 16903A you would want the 16903-14100, 16903-14104, or 16903-14107 recovery images.Code:168xA/AD Win XP MY41000801-MY41000899 Radisys SC815E 01680-14100MY41000901-MY41001099 Motorola VP22 01680-14104MY41001101-later ADLINK M-815G 01680-14106168xxA MY46000101-MY46000999 Intel D915GUX 16800-14102MY46001000-later ADLINK M-880 16800-1410316900A, 16902A MY43000001-MY43001999 Motorola VP22 16900-14109MY43002000-later ADLINK M-815G 16900-1412116901A MY46000101-MY46000399 Intel D915GUX 16901-14101MY46000400-later ADLINK M-880 16901-1410216902B All ADLINK M-880 16902-1410016903A MY43000001-MY43000199 Radisys SC815E 16903-14100MY43000200-MY43001999 Motorola VP22 16903-14104MY43002000-later ADLINK M-815G 16903-14107If your serial number starts with SG, then the same number ranges apply.For example, SG43000001 is the same as MY43000001

author: wwmartin
author_rank: Newbie
timestamp: December 17, 2021, 07:30:05 pm
content: Well, I tried the current version "son of ERD", made the bootable .iso, went to boot it and it failed...only runs on 64bit hardware. Very clever! Seems to me that the most likely system to need such a password resetting tool would be an OLD system. Not so likely to be 64bit...but what do I know.

author: wwmartin
author_rank: Newbie
timestamp: December 17, 2021, 07:44:18 pm
content: That's good stuff. Many thanks for that table, my machines sn is my43002647, so it would be the ADLINK M-815G board. Nice to know that this is a later production machine! The key & mouse connectors colors/location of the stacked io connectors also match that model in the .png image. So the big question is: how do I get the .iso recovery image that matches this? Is it downloadable?-bill

author: gslick
author_rank: Frequent Contributor
timestamp: December 17, 2021, 09:37:45 pm
content: The BIOS POST screen should also have some text indicating that it is an M-815G motherboard, as highlighted in the screen photo below.The recovery CD ISO images used to be available for download from ftp.keysight.com a few years ago, but almost everything useful there has now been purged. Fortunately the Internet Archive has a snapshot from 2015 which contains the 16903A recovery CD ISO images. For the 16903-14107 version it appears to be a single DVD image instead of multiple CD images.Try these links. Be patient, the 16903-14107_disk_1.iso image is 1,874,266,112 bytes in size.Code:https://archive.org/download/ftp.keysight.com/2015.03.ftp.keysight.com.tar/ftp.keysight.com%2Fcos%2Foutbound%2F16xxx%20recovery%20images%2F16903-14107%2F16903-14107.pdfhttps://archive.org/download/ftp.keysight.com/2015.03.ftp.keysight.com.tar/ftp.keysight.com%2Fcos%2Foutbound%2F16xxx%20recovery%20images%2F16903-14107%2F16903-14107_disk_1.isohttps://archive.org/download/ftp.keysight.com/2015.03.ftp.keysight.com.tar/ftp.keysight.com%2Fcos%2Foutbound%2F16xxx%20recovery%20images%2F16903-14107%2F5965-3975_recovery_cd_insert.pdf

author: wwmartin
author_rank: Newbie
timestamp: December 17, 2021, 10:12:34 pm
content: That's good stuff. Many thanks for that table, my machines sn is my43002647, so it would be the ADLINK M-815G board. Nice to know that this is a later production machine! The key & mouse connectors colors/location of the stacked io connectors also match that model in the .png image. So the big question is: how do I get the .iso recovery image that matches this? Is it downloadable?-billQuote from: gslick on December 17, 2021, 09:37:45 pmJust now got past the initial password roadblock, using the tools at "https://pogostick.net/~pnh/ntpasswd/"There is still some work to do to finish cleaning up the remaining corporate tangle of domains vs users, but Admin on the local machine got me running. Will definitely pick up the archived files, in case the disc goes belly up in the future! So far it 's looking good, passes all the self tests on the hardware. Hope I can convince it to not want Internet Explorer for anything! That might be having to do with the various domains it knows about...not sure. Seems to have been living at Qualcomm in the past!

author: rfclown
author_rank: Frequent Contributor
timestamp: December 17, 2021, 10:26:47 pm
content: how about logging in as administrator (usually Instrument or Administrator). Those passwords are published. Usually things like measure4u, agilent4u, keysight4u, Keysight4u!

author: eti
author_rank: Super Contributor
timestamp: December 17, 2021, 10:31:44 pm
content: Bypassing Windows "security" is amusingly trivial, and there are far too many guides out there to achieve it.