The Security Accounts Manager (SAM) is stored in the key:
HKEY_LOCAL_MACHINE\SAM\SAM
Sub keys:
Name | Description |
---|---|
Domains | Built-in and account domains |
RXACT |
Values:
Name | Data type | Description |
---|---|---|
C | REG_BINARY |
The C value data is variable of size and consists of:
Offset | Size | Value | Description |
---|---|---|---|
0 | 2 | Unknown (Format version?) | |
2 | 2 | Unknown | |
4 | 4 | Unknown (empty?) | |
8 | 4 | Security descriptor data size | |
12 | 2 | Unknown | |
14 | 2 | Unknown | |
16 | ... | Security descriptor data |
Value | Description |
---|---|
1 | Used in Windows NT 3.1 |
2 | Used in Windows NT 3.5 |
3 | Used in Windows NT 4 |
6 | Used in Windows 2000 |
7 | Used in Windows XP and later |
9 | Used in Windows Windows 11 |