Just use NTPASSWD, it's been around forever. A lot of Linux bootable recovery systems have it built in.
http://pogostick.net/~pnh/ntpasswd/
+
+
=== Update (09/08/2017) ===
+
+
It has been a while since my original comment.
+
+
I've used (and still use) ntpasswd for many years from XP thru Windows 8 on hundreds of systems and have blanked out the user admin password. The key word here is BLANK out the password.
+
+
It is just a matter of following the menus by selecting the drive with the sam file, listing the windows accounts, unlocking the account using the id of the account, it will be something like 0x01b3, then selecting the option to blank the password. Last, when you quit, it will ask if you would like to write the changes. Restart and at the Windows login screen click on the account that was unlocked and leave the password field blank. Once inside Windows you can go to the user account and set a new password.
+
+
For Windows 10 systems, with a Local Account (only), I've used this guide several times without a problem.