'Microsoft' Changed PC Password

My brother is a smart guy, but gullible to the point of idiocy.

He got a phone call a couple weeks ago. Caller ID said it was Microsoft, and he answered it. I know... stupid thing 1. The guy on the other end of the line said that his computer was running slow and needed a tuneup. They said they could easily speed it up remotely, and that he should open a browser and type in an address, followed by a code they would supply

And he did it! Stupid thing 2. He entered the web address and the code and allowed them to remotely access his 6 month old Lenovo Windows 10 desktop. They told him that he could do something else while they ran diagnostics. So he put the phone on speaker and emptied his dishwasher. ST3.

Ten minutes later he returned, only to be informed that to completely optimize his unit as well as remove adware and viruses would cost him $189.00.

Now he didn't pay them any money which should maybe be designated Smart thing 1, except that the 3 stupid things he had done sort of made that a case of 'too little, too late'.

Now when he turns on his PC it boots to the password screen where instead of his name it gives a phone number. Needles to say his Windows password no longer works.

I turned his computer off 4 times in a row with power button. The next time I turned it on it went into the Troubleshooting screen and I accessed System Restore. Unfortunately he had no restore points that predated the call from 'Microsoft'. I saw nothing else that seemed like it would be helpful in the Advanced Repair options.

So I brought his tower home with me and started his desktop with my W10 DVD.

So here's where I need guidance. I can't find a darn thing using that disk that will help me remove whatever password 'Microsoft' put on his computer. I even tried a search on this forum and came up empty.

Can anyone provide me with a step by step set of instructions? Or a link to a website that would help me?

I would try Kyhi's Recovery Tools:
Windows 10 Recovery Tools - Bootable Rescue Disk - Windows 10 Forums

See if you can read any data from the hard drive. It might have been encrypted. There is also a password "recovery" tool as well.

boweasel said:

I turned his computer off 4 times in a row with power button. The next time I turned it on it went into the Troubleshooting screen and I accessed System Restore. Unfortunately he had no restore points that predated the call from 'Microsoft'. I saw nothing else that seemed like it would be helpful in the Advanced Repair options.

See if you can recover any user files using the Kyhi recovery drive as suggested by @NavyLCDR.

As @Brink says, "I would be afraid his computer may be infected now".

You may be able to 'factory reset' the PC. As you can get to Advanced Start up by the 'hard reboot' method a factory reset should be one available option.

Reset Windows 10 | Tutorials

Okay, I tried Option Two of the tutorial...

• Which required me to enable the built-in Administrator account
• So I booted from the disk
• Went to Command Prompt
• Typed in regedit, went to Load Hive, navigated to C:\Windows\System32\config, did the SAM, REM_SAM business, the 000001F4 thing, changed line 38, column 1 from 10 to 11, closed regedit, clicked Continue and booted to the password screen

Which gave me no previously unseen option to log on as an administrator, still showed a phone number instead of my brother's name, and still refused to accept his password.