technique(s) LARGEMENT connue(s) mais je poste quand même...

dans les comments :

- For mac in 140 chars:reboot>hold Command + R>Click the Utilities menu > select Terminal> type resetpassword > press enter. Macs are Secure!
- Reboot > command+S > "mount -uw /" > "ls /Users" > "passwd [username]"

Then what to do ?
- To add accounts: "net user AccountName /add". To grant admin: "net localgroup Administrators /add AccountName".
- Once you get to the cmd prompt type "net user administrator /active:yes" There are much easier ways to do this...

Why it works :
- The reason this works is that Windows doesn't check the integrity of the Sticky Keys executable and just runs it regardless.
- 1/2: The reason why this works, is that the processes in the logon-environment always is started in context of the system user.

Other options...
- Hirens boot CD >Tools >Security> Reset Admin Password >follow Prompt (yes) Reboot no Password. Takes 2 minutes and less fart ass ing about.
- I think changing sethc by registry debug value to cmd is much neater. But that works too. That debug can be also used for many other things.

Countermeasures :  
- Windows : System Settings -> Security and Privacy -> File Vault.
- As a network manager, disable startup repair via group policy. Fixed.
- bcdedit /set {default} recoveryenabled No
- Unless it's a public machine (home/work),you can prevent this by adding disk encryption or even a BIOS boot password.Just don't forget them.
-Disable Startup Repair with: bcdedit /set {default} bootstatuspolicy ignoreallfailures