1
How to connect to a remote computer running RealVNC when you don’t know the password.
Query the registry for the encrypted password:
PsExec \\Remote-PC REG QUERY HKLM\Software\RealVNC\WinVNC4 /v Password
Change the password to “a”:
PsExec \\Remote-PC REG ADD HKLM\Software\RealVNC\WinVNC4 /v Password /t REG_BINARY /d d8d1e367e1d17646 /f
Can’t connect with password? Check for “Prompt local user to accept connections”:
PsExec \\Remote-PC REG QUERY HKLM\Software\RealVNC\WinVNC4 /v QueryConnect
Disable “Prompt local user to accept connections”:
PsExec \\Remote-PC REG ADD HKLM\Software\RealVNC\WinVNC4 /v QueryConnect /t REG_DWORD /d 0 /f
Disable “Too many security failures”:
PsExec \\Remote-PC REG ADD HKLM\Software\RealVNC\WinVNC4 /v BlacklistTimeout /t REG_DWORD /d 0 /f
A better way, bypass the password instead of changing it.
Set RealVNC to “No Authentication” and connect without a password:
PsExec \\Remote-PC REG ADD HKLM\Software\RealVNC\WinVNC4 /v SecurityTypes /t REG_SZ /d None /f
Change RealVNC back to “VNC Password Authentication”:
PsExec \\Remote-PC REG ADD HKLM\Software\RealVNC\WinVNC4 /v SecurityTypes /t REG_SZ /d VncAuth /f
NOTE: In this example I used RealVNC Server Free Edition v4.1.3 in Service-Mode.
Use “HKCU” if RealVNC is running in User-Mode, and “HKLM” if running in Service-Mode.
PsExec is a command line utility found in Sysinternals PsTools.
