SysKey - Create USB Key to Lock or Unlock Windows

How to Create a USB Startup Key to Lock or Unlock Windows​

   Information

SysKey (SAM Lock Tool) is an in-built Windows utility that can help you secure the Security Accounts Management or SAM database. The SAM Database stores hashed copies of your user passwords, which is encrypted with a locally stored system startup key by default.

You can use SysKey to store the startup key locally in Windows or on a USB flash drive. Having the startup key stored on a USB flash drive instead will give you better security since the USB flash drive must be connected at startup to be able to login and gain access to Windows.

This tutorial will show you how to use SysKey to be able to create a USB flash key "Startup Key Disk" to lock or unlock Vista, Windows 7, or Windows 8 with.

You must be logged in as an administrator to be able to do the steps in this tutorial.

   Note

If you Lock Windows with OPTION ONE:

• The startup key placed on the USB flash drive is only good to gain access to logon to the specific Windows that it was created in.
• This will only lock the Windows computer at boot from a cold startup after a restart or shut down. It will not lock Windows after a log off, lock, or switch user.
• Once Windows has started after logging in, you will no longer need to have the USB flash drive connected. It is only required to be connected at system startup at boot.
• You will still be able to continue to use the USB flash drive as normal. Just do not ever delete the StartKey.Key file on it, or you will not be able to unlock Windows with it anymore.
• It is recommended to create a USB flash drive per user that you wish to be able to log in from startup.

EXAMPLE: Windows Startup
NOTE: This is an example of what you will see at Windows startup after using OPTION ONE. Windows will not startup until you connect the USB startup key.

OPTION ONE

To Lock Windows to Require a USB Key at Startup to Unlock

NOTE: This option will store the startup key on your USB flash key instead of locally. It will require the USB flash drive to be connected at system startup to be able to unlock Windows.
1. If you have not already, you will need to change the drive letter of the USB flash drive to have the letter A. (see screenshot below)

2. Press the Windows+R keys to open the Run dialog, type syskey, and click/tap on OK.

3. If prompted by UAC, then click/tap on Yes (Windows 7/8) or Continue (Vista).

4. Click/tap on Update. (see screenshot below)

5. Select (dot) System Generated Password, select (dot) the Store Startup Key on Floppy Disk option, and click/tap on OK. (see screenshot below)

6. If you have not already, connect the USB flash drive with the drive letter of A from step 1, and click/tap on OK. (see screenshot below)

7. Click/tap on OK. (see screenshot below)

   Note

• This places the StartKey.Key file on the USB flash drive. If you already have an existing StartKey.Key file on the USB, then the older existing one would be renamed to StartKey.Bak for the new one to be saved to it.
• It is recommended that you keep a backup of this StartKey.Key file at another location in case the USB gets corrupted or lost. This way you will be able to copy it to another USB with a drive letter of A to be able to gain access to Windows again.

8. Click/tap on OK. (see screenshot below)

9. Windows will now require this USB flash drive to be connected at startup when you boot your computer to be able to login to Windows.

OPTION TWO

To Unlock Windows to Not Require a USB Key at Startup

NOTE: This option is the default setting in Windows to store the startup key locally. It will undo OPTION ONE to have Windows no longer require the USB flash drive at startup.
1. Press the Windows+R keys to open the Run dialog, type syskey, and click/tap on OK.

2. If prompted by UAC, then click/tap on Yes (Windows 7/8) or Continue (Vista).

3. Click/tap on Update. (see screenshot below)

4. Select (dot) System Generated Password, select (dot) the Store Startup Key Locally option, and click/tap on OK. (see screenshot below)

5. If you have not already, connect the USB flash drive with the drive letter of A from OPTION ONE, and click/tap on OK. (see screenshot below)

6. Click/tap on OK. (see screenshot below)

7. Windows will now no longer require the USB flash drive to be connected at startup for access.
That's it,
Shawn

Related Tutorials

---

• How to Set a Startup Password to Lock or Unlock Windows
• How to Turn BitLocker On or Off without a TPM for Windows 7 Drive
• How to Turn Windows 7 BitLocker On or Off for Internal Data Hard Drives

 

[Kari]

Very good and very useful tutorial.

A question: System generates password. Can I backup it to another USB stick? I mean, I would like to use this method on a laptop that normally always follows me and is often left unattended (though locked to Welcome screen) but I would not like to have only one USB to boot the computer. What if the USB gets corrupted? I would like to have "a set of spare keys".

Kari

 

[Brink]

Hello Kari,

Thank you.

Yes, you can backup the StartKey.Key file that is placed on the USB key. The only requirement to restore it is to have a USB key drive with the drive letter as A for it, and copy the StartKey.Key file to the USB's root directory.

It would be a very smart idea to backup the StartKey.Key file.

 

[Kari]

OK. Thanks.

 

[Brink]

You're welcome.

 

[bej]

One (silly ?) question. Since I don't have a floppy drive (it's turned off in BIOS), do I need to turn it on for the USB logon to work ?

 

[Brink]

Hello Bej,

No, you sure don't since this is at Windows startup and not at boot. Having the USB flash drive set with the drive letter A is all Windows needs for the USB flash drive to work at startup for this.

 

[bej]

Thank you for responding.

 

[Brink]

You're most welcome. Please let us know how it went for you.

 

[bej]

The tutorial worked perfectly. Appreciate all your work on this website.

 

[Brink]

The tutorial worked perfectly. Appreciate all your work on this website.

Great news.

 

[woodwardpj]

Drive letter

Thanks for this great tip I really appreciate all the knowledge here. I saw the post about creating a backup which I did. My problem is my system isn't allowing me to have two usb drives with the same letter (I don't have them both plugged in at the same time, I unplug one and reinsert the other, assign it drive a then plug the first one in and it's back to drive e). Any thoughts?

 

[Brink]

Hello Woodward, and welcome to Seven Forums.

This would be normal. Each drive has a unique hardware ID (HID) number that it is referenced by when it is connected and assigned a drive letter. This is how Windows knows what drive letters are used and what to give it the next time it's connected.

It's really best to let each drive to have it's own drive letter so Windows will know what files are on each drive. If you really must use the same drive letter, then you could use OPTION TWO in the tutorial below to change the drive letter, but you'll have to do it each time you connect either drive.

http://www.sevenforums.com/tutorials/82994-drive-letter-add-change-remove-windows-7-a.html

Hope this helps some,
Shawn

 

[woodwardpj]

Assigning a drive to usb's.

Thanks Shawn;

That does help but it leaves me with the question of how do I get the start key to work on my computer if my original usb drive becomes corrupt? My second usb is not recognized as drive a anymore.

Could I assign it as drive a on another machine?

Thanks again, Phil

 

[Brink]

You're welcome Phil,

It doesn't matter what USB key the StartKey.Key file is on for it to work to unlock Windows so long as the StartKey.Key file is on it and connected.

The blue NOTE box under step 7 Option One can give you more details, but you should keep a copy of the StartKey.Key file backed up somewhere safe in case your USB key does get corrupted, lost, broken, etc.... This way you could just copy the backup of the StartKey.Key file to a new USB, and be good to go.

 

[woodwardpj]

My mistake

Thanks again, i was confusing the drive a requirement with predator, which i use also. Sorry about that and thanks again.

 

[Brink]

You're most welcome Phil. It's no problem.

 

[Amnesia180]

Hi, I have a question on this.

Should I lose the USB key, and the spare USB key... would it work if I stored that file on something like "Google Drive" so I can access it from any computer, then drag/drop the file onto the USB stick, then I can just put it into the laptop and it will work again. Is that correct?

I'm worried about never being able to access the laptop ever again if something went wrong!

 

[Brink]

Hello Amnesia,

Yes, that would work as well. As long as that StartKey.Key file is on the root directory of a connected USB key, you would be good to go.

 

[Amnesia180]

Brilliant, thank you. Does the USB key always have to read as the same drive number? How would I ensure this?