Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
How are windows passwords handled?

can someone give me idea regarding how passwords are being stored inside the windows operating system?

share|improve this question

migrated from stackoverflow.com Jan 19 '11 at 18:12

This question came from our site for professional and enthusiast programmers.

marked as duplicate by grawity, Arjan, Sathya, Sasha Chedygov, Nifle Jan 20 '11 at 13:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

6  
Sure, want my credit card information too? –  George Jan 19 '11 at 18:07
1  
What version of Windows? In a domain? –  gbn Jan 19 '11 at 18:07
4  
That's a horrible title. –  SLaks Jan 19 '11 at 18:10
1  
@George it's not terribly private. Everyone knows that your windows passwords are about as secure as your birthday. Ever heard of ophcrack? –  Rafe Kettler Jan 19 '11 at 18:12
    
Title changed to something a little more accurate –  BBlake Jan 19 '11 at 18:16

2 Answers 2

They are hashed using the NTLMv2 algorithm and stored in the SAM.

share|improve this answer

Normally, Windows store passwords on single computer systems in the registry in a hashed format using the NTLM algorithm. The registry file is located in

C:\windows\system32\config\SAM. 

This area of the registry has restrictive permissions so that a normal user cannot see the contents of HKLM\SAM deep enough to access the hash. In order to view the hashes one must change the permissions on the registry keys, this requires an administrative account on the system in Windows XP. I am unsure if access is possible using an administrator account in Vista or 7.

Once one has access to the password hashes though, it is difficult to gain the passwords again. There are many places on the internet that you can find information about brute forcing a NTLM hash. However, if you are simply trying to reset a password, I would recommend using Offline NT Password and Registry Editor.

If you want to get your arms wet though, the hash is stored under the key

HKLM\SAM\SAM\Domains\Account\Users\00000XXX 

with a value named V. The hash is stored at a variable offset that is stored at offset 0x9C and is a 4 byte little endian value.

share|improve this answer