up vote 0 down vote favorite
share [g+] share [fb]

Possible Duplicate:
How are windows passwords handled?

can someone give me idea regarding how passwords are being stored inside the windows operating system?

link|improve this question
6  
Sure, want my credit card information too? – George Jan 19 '11 at 18:07
1  
What version of Windows? In a domain? – gbn Jan 19 '11 at 18:07
4  
That's a horrible title. – SLaks Jan 19 '11 at 18:10
1  
@George it's not terribly private. Everyone knows that your windows passwords are about as secure as your birthday. Ever heard of ophcrack? – Rafe Kettler Jan 19 '11 at 18:12
Title changed to something a little more accurate – BBlake Jan 19 '11 at 18:16
feedback

migrated from stackoverflow.com Jan 19 '11 at 18:12

This question came from our site for professional and enthusiast programmers.

closed as exact duplicate by grawity, Arjan, Sathya♦, Sasha Chedygov, Nifle Jan 20 '11 at 13:27

This question covers exactly the same ground as earlier questions on this topic; its answers may be merged with another identical question. See the FAQ for guidance on how to improve it.

2 Answers

up vote 5 down vote

They are hashed using the NTLMv2 algorithm and stored in the SAM.

link|improve this answer
feedback
up vote 3 down vote

Normally, Windows store passwords on single computer systems in the registry in a hashed format using the NTLM algorithm. The registry file is located in 

C:\windows\system32\config\SAM.

This area of the registry has restrictive permissions so that a normal user cannot see the contents of HKLM\SAM deep enough to access the hash. In order to view the hashes one must change the permissions on the registry keys, this requires an administrative account on the system in Windows XP. I am unsure if access is possible using an administrator account in Vista or 7.

Once one has access to the password hashes though, it is difficult to gain the passwords again. There are many places on the internet that you can find information about brute forcing a NTLM hash. However, if you are simply trying to reset a password, I would recommend using Offline NT Password and Registry Editor.

If you want to get your arms wet though, the hash is stored under the key 

HKLM\SAM\SAM\Domains\Account\Users\00000XXX

with a value named V. The hash is stored at a variable offset that is stored at offset 0x9C and is a 4 byte little endian value.

link|improve this answer
feedback