SysKey - Create USB Key to Lock or Unlock Windows

How to Create a USB Startup Key to Lock or Unlock Windows​

   Information

SysKey (SAM Lock Tool) is an in-built Windows utility that can help you secure the Security Accounts Management or SAM database. The SAM Database stores hashed copies of your user passwords, which is encrypted with a locally stored system startup key by default.

You can use SysKey to store the startup key locally in Windows or on a USB flash drive. Having the startup key stored on a USB flash drive instead will give you better security since the USB flash drive must be connected at startup to be able to login and gain access to Windows.

This tutorial will show you how to use SysKey to be able to create a USB flash key "Startup Key Disk" to lock or unlock Vista, Windows 7, or Windows 8 with.

You must be logged in as an administrator to be able to do the steps in this tutorial.

   Note

If you Lock Windows with OPTION ONE:

• The startup key placed on the USB flash drive is only good to gain access to logon to the specific Windows that it was created in.
• This will only lock the Windows computer at boot from a cold startup after a restart or shut down. It will not lock Windows after a log off, lock, or switch user.
• Once Windows has started after logging in, you will no longer need to have the USB flash drive connected. It is only required to be connected at system startup at boot.
• You will still be able to continue to use the USB flash drive as normal. Just do not ever delete the StartKey.Key file on it, or you will not be able to unlock Windows with it anymore.
• It is recommended to create a USB flash drive per user that you wish to be able to log in from startup.

EXAMPLE: Windows Startup
NOTE: This is an example of what you will see at Windows startup after using OPTION ONE. Windows will not startup until you connect the USB startup key.

OPTION ONE

To Lock Windows to Require a USB Key at Startup to Unlock

NOTE: This option will store the startup key on your USB flash key instead of locally. It will require the USB flash drive to be connected at system startup to be able to unlock Windows.
1. If you have not already, you will need to change the drive letter of the USB flash drive to have the letter A. (see screenshot below)

2. Press the Windows+R keys to open the Run dialog, type syskey, and click/tap on OK.

3. If prompted by UAC, then click/tap on Yes (Windows 7/8) or Continue (Vista).

4. Click/tap on Update. (see screenshot below)

5. Select (dot) System Generated Password, select (dot) the Store Startup Key on Floppy Disk option, and click/tap on OK. (see screenshot below)

6. If you have not already, connect the USB flash drive with the drive letter of A from step 1, and click/tap on OK. (see screenshot below)

7. Click/tap on OK. (see screenshot below)

   Note

• This places the StartKey.Key file on the USB flash drive. If you already have an existing StartKey.Key file on the USB, then the older existing one would be renamed to StartKey.Bak for the new one to be saved to it.
• It is recommended that you keep a backup of this StartKey.Key file at another location in case the USB gets corrupted or lost. This way you will be able to copy it to another USB with a drive letter of A to be able to gain access to Windows again.

8. Click/tap on OK. (see screenshot below)

9. Windows will now require this USB flash drive to be connected at startup when you boot your computer to be able to login to Windows.

OPTION TWO

To Unlock Windows to Not Require a USB Key at Startup

NOTE: This option is the default setting in Windows to store the startup key locally. It will undo OPTION ONE to have Windows no longer require the USB flash drive at startup.
1. Press the Windows+R keys to open the Run dialog, type syskey, and click/tap on OK.

2. If prompted by UAC, then click/tap on Yes (Windows 7/8) or Continue (Vista).

3. Click/tap on Update. (see screenshot below)

4. Select (dot) System Generated Password, select (dot) the Store Startup Key Locally option, and click/tap on OK. (see screenshot below)

5. If you have not already, connect the USB flash drive with the drive letter of A from OPTION ONE, and click/tap on OK. (see screenshot below)

6. Click/tap on OK. (see screenshot below)

7. Windows will now no longer require the USB flash drive to be connected at startup for access.
That's it,
Shawn

Related Tutorials

---

• How to Set a Startup Password to Lock or Unlock Windows
• How to Turn BitLocker On or Off without a TPM for Windows 7 Drive
• How to Turn Windows 7 BitLocker On or Off for Internal Data Hard Drives

 

[Brink]

Brilliant, thank you. Does the USB key always have to read as the same drive number? How would I ensure this?

Nope. It doesn't matter about the USB key. It only matters that the StartKey.Key file is in the root directory of it.

 

[James ProBook]

recovery using saved syskey

I'll start with saying I am not a technical genius. I set my lap top up for a SAM lock. Put the syskey on my usb with letter A and have been happily using it for almost a year. My usb has shorted out and is now corrupt (that alone was a new education in what technology can do). I made a spare copy of the syskey (as a saved file) onto another computer and have now loaded it onto a brand new usb key (same model as the old one), but the computer won't accept it. The syskey is in the root directory. Using my other computer I assigned it drive letter A. How do I now get my locked laptop to accept the new usb key to unlock my computer?

 

[Brink]

Hello James, and welcome to Seven Forums.

Was the USB formatted as FAT32, and the SysKey copied to the root of the USB flash drive?

While the other computer may think the new USB is A:, the original computer most likely assigned it a different drive letter since the other USB was assigned to A.

See if assigning A: to the new USB in a command prompt at boot on your original computer may work.

• http://www.sevenforums.com/tutorials/682-command-prompt-startup.html
• http://www.sevenforums.com/tutorials/119713-diskpart-pc-startup.html

In the command prompt, type the commands below, and press Enter after each one. When successfully finished, restart the computer to see if it works.

• diskpart
• list volume (make note of the volume number for the USB flash drive)
• select volume # (substitute # for the actual volume number of the USB flash drive)
• assign letter=A

Hope this helps,
Shawn

 

[James ProBook]

Dumb questions - how do I get the command prompt? I know after logging in I press Wdw+r. How do I do it on the boot up?

 

[Brink]

The two links above can help show you a few ways to do so.

 

[James ProBook]

the above 2 links require I have the install disks?
I purchased the computer set up about 2 years ago and don't have the disks.
I have been able to get to the HP BIOS using the Esc key - but cannot get either shift F10 or F8 to give me a command line prompt.
Launching in repair causes it to try to run it's own diagnostics - which when complete put me back at the screen which asks for the boot disk with the SysKey.
I can get into the HP BIOS - but it is an HP GUI not a command prompt.

 

[Brink]

In that case, you could download an official Windows 7 ISO at the link below,....
Windows 7 Direct Download Links, Official Disk Images from Digital River
...and create a bootable Windows 7 installation DVD/USB with the ISO file.
http://www.sevenforums.com/tutorials/31541-windows-7-usb-dvd-download-tool.html

 

[James ProBook]

UPDATE: did manage to get it to start in safe mode with a command prompt (as shown in the first link) by beating on the F8 key during boot up (but has to be a boot from off not a restart on my machine). New problem, after it runs the script to load the drivers it does not leave me at a command line - it pops up the Startup key Disk box and asks for my start up key to be inserted .... which is back to my initial problem I think??

 

[IndieArchive]

Great information, I see one potential problem with "spare keys". I obsessivly change drive letters a lot, and have found that whenever you assign a drive letter, (A), the computer forgets the previous "A" drive assignment.

I think that when you assign the Spare Key as "A" it would no longer see the first one as "A" unless it was identical size and signiture.

I suggest that anyone doing this should confirm that each USB stick is seen as "A" beforehand.

 

[eso]

Brink thanks a lot for this Great tutorial .

 

[bhanukpr]

Startup key.key lost

Hi Sir,
I have created the "USB KEY" to lock my computer by using my pendrive. But now i have lost my Startup key.key file and now i am unable to open my laptop. Please help me " How to open my Laptop ? " or "how to recover my Startup key.key file ?". That pendrive was formated my friend unknowingly.

 

[Brink]

Hello,

I'm afraid that if you don't have a backup of this StartKey.Key file to restore on a USB to unlock your PC, then you'll need to reinstall Windows.

If you have another computer, then you could connect the hard drive to it to backup any files that you may want first.

 

[Kari]

If you have another computer, then you could connect the hard drive to it to backup any files that you may want first.

Noob question: I have always assumed that the process encrypts the disk, too, making it unusable if the key is lost even when the HDD is removed from the computer in question. So this process only protects your data as long as the HDD is not removed and connected to another computer? Protecting the computer instead of protecting the HDD?

 

[Brink]

Hey Kari,

No problem. SysKey was meant to encrypt SAM to protect against offline password cracking attacks by preventing the possessor of an unauthorised copy of the SAM from extracting information from it.

https://en.wikipedia.org/wiki/Syskey

Today, it would be better to use BitLocker to encrypt the Windows disk to prevent any unauthorized access at all.

 

[Kari]

Thanks for clearing this for an encryption noob

 

[Brink]

De nada mate.

 

[russtee]

A Couple of Questions

G'day!!

Thank you very much for the easy to read and follow tutorials!!

I just have a couple of questions:

Is there any advantage using a USB with the SYSKEY key on it to boot along with BitLocker or Truecrypt FDE? Just to store SAM access remotely; especially is the computer is left on and unattended in Windows 'Locked' mode for long periods (it runs services for the network).

How to you reissue the SYSKEY key on a regular basis; in order to maintain security in case of compromised USB key? I'm assuming anyone who has access to that USB for more than a few seconds will be able to copy it and decrypt the SAM db at leisure?

Also is there a windows (and/or Linux) USB solution where on removal of a USB with an encryption key on it the entire system is paralysed? So no CD, USB, BIOS, internal or external ports/slots/sockets (including RAM) can be modified? Some systems and services can be selected to continue while most can not and Firewall rules are modified to a Key In or Key Out rule sets? This would allow a computer to run however if physical control wasn't maintained there would still be a level of security from Evil Maid type attacks.

Once again, love your work and simple step by step instructions!

Cheers

Rustee

 

[Brink]

Hello Rustee, and welcome to Ten Forums.

For what you're wanting, using BitLocker on all drives should work well. SysKey could be used for additional security, and used on the same USB for BitLocker. Yeah, you don't want anyone to have access to the USB except yourself since it'll whomever has it access.

You might also setup a BIOS/UEFI password. This way the PC will not boot until you enter the BIOS/UEFI password first.

You could also keep the computer in a locked secure room if you're concerned about a maid or someone in the house having physical access to it.

 

[MikePlaysCoder]

I know this is a SUPER old post, but it's the closest to what I'm looking for that I've found so far. We distribute PC's with games on them. I have seen that some gaming PC's will have USB keys in them that can't seem to be read on any computer except the one they were created on. Does the approach described here work like that? If I would turn on BitLocker and use a USB key with the Syskey info on it, can the person purchasing the game duplicate the drive and duplicate the USB key and use them in another PC with the same hardware?

We are trying to prevent them from just building extra PC's and dropping cloned hard drives in them with cloned usb keys. And don't want to force them to have the games online.

Thanks!

 

[Brink]

Hello Mike, and welcome to Seven Forums.

That's correct. The SysKey USB can only be used on the computer it was created on.

While the StartKey.Key file on the USB can be copied to any USB to be able to use that USB to unlock the computer with.

I'm not sure if the USB will still work on a cloned PC though.