← Back to ProDirt Blog
March 25, 2026 IT

Server Won't Boot to Domain and the NIC Is Dead — Getting Back In With Hiren's

Lost the NIC, domain auth is gone, and Windows is refusing blank password logins. One registry key is all that's standing between you and the desktop.

The scenario: a server loses its NIC. Could be hardware failure, could be a driver blowup after an update — doesn't matter. Point is it has no network. The domain is unreachable, cached credentials aren't working for whatever reason, and you need in. So you boot Hiren's, use NTPWEdit or chntpw to clear the local Administrator password, reboot — and Windows throws this at you: 

The account is not authorized to log in from this station.

Or some variation of it that amounts to: blank password, won't let you in. Frustrating, because you just cleared the password. The tool said it worked. What's happening?

The Real Problem: LimitBlankPasswordUse

Windows has a security setting called LimitBlankPasswordUse that prevents accounts with blank passwords from being used for interactive console logins. It's on by default and it's enforced at the OS level, independently of whether you have a domain or network access.

When you clear the password with NTPWEdit, you've successfully blanked the account — but this policy is still in place, blocking you from using that blank account to actually get through the login screen. The fix is to temporarily disable that restriction via an offline registry edit, which you can do right from Hiren's without rebooting again.

The Fix

Boot into Hiren's BootCD PE. Open a Command Prompt. Run this to load the offline SYSTEM hive: 

reg load HKLM\TEMPSYSTEM C:\Windows\System32\config\SYSTEM

Then flip the flag: 

reg add "HKLM\TEMPSYSTEM\ControlSet001\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f

Unload the hive cleanly: 

reg unload HKLM\TEMPSYSTEM

Reboot into Windows normally. The local Administrator account with a blank password will now log in.

⚠️ Don't leave it like this. Once you're in, set a real password on the Administrator account immediately, then flip LimitBlankPasswordUse back to 1. A server with a blank admin account sitting on any network is a problem waiting to happen.

Why the C Drive Path May Be Different

Hiren's PE has its own drive letter assignments. What Windows calls C:\ might show up as D:\ or E:\ in the PE environment. Before running the reg load command, open a file browser in Hiren's and confirm which drive letter holds the Windows installation. Look for the Windows\System32\config folder to verify.

ℹ️ ControlSet001 vs CurrentControlSet: In the offline hive, you reference ControlSet001 directly — CurrentControlSet is a symlink that only works when Windows is running. On most systems ControlSet001 is the right one, but if you're not sure, check which ControlSet number is set as Current under HKLM\TEMPSYSTEM\Select after loading the hive.

After You're In

Once you've logged in, the first priority is sorting out why cached credentials weren't working in the first place. If this was a domain-joined machine and the cache was just stale or corrupted, fixing the NIC and rejoining the domain (or just restoring network connectivity) will usually restore normal operations. Set a local admin password, document it somewhere secure, and make sure you have a break-glass account that isn't dependent on the domain for exactly this kind of situation.

Wrapping Up

The sequence that works: boot Hiren's → clear the password with NTPWEdit or chntpw → load the offline SYSTEM hive → set LimitBlankPasswordUse to 0 → reboot → log in → set a real password → flip it back to 1. In that order. Skipping the registry step is why most people get stuck after clearing the password and wonder why Windows is still refusing them.

It's one of those things that's not obvious until you've been bitten by it, and then it's permanently in your toolbox.

← All Posts ProDirt Apps →