Boot in windows 2000 server CD
Repair and recovery console
Navigate to system 32.
You can also boot in to Linux and try doing it using file manager if you prefer a GUI
C:\Windows\System32\osk.exe is the on screen keyboard in accessibility options. Rename it and then rename cmd.exe as osk.exe
ren osk.exe osk.exe.old
ren cmd.exe osk.exe
Reboot
Accessibility options
OSK will run CMD in administrator mode
net user username password
You can also add a user net user username password /add
Do not forget to rename osk.exe to plug the security hole.