25

Where are Microsoft Windows 7 passwords and credentials stored on disk?

I would like to physically verify that the Users group does not have access to files containing system passwords.

Improve this question

2 Answers 2

Reset to default
22

Windows account details are stored in the SAM registry hive. It stores passwords using a one-way-hash (either LM Hash, which is old and weak, or NTLM hash which is newer and stronger.)

The SAM hive file is located at %WinDir%\system32\config\sam. This directory, and it parents, are by default inaccessible to non-administrative users. However it is vulnerable to offline attacks (e.g. booting a LiveCD and manually modifying the binary data. For example with the ONTPRE tool.)

Improve this answer
4

They are stored per user in C:\users\username\AppData\Roaming\Microsoft\credentials and also in C:\users\username\AppData\Roaming\Microsoft\Vault . Since this is in a user directory it's safe to say only the user and computer/domain admins have access to it. Not to mention it is also encrypted.

Improve this answer
12
  • 2
    Encryption isn't hard to break with some reading on the net - I found this out earlier this year at school
    – cutrightjm
    Dec 13, 2011 at 17:39
  • 4
    Neither of these locations relate to where Windows stores user account passwords.
    – Andrew Lambert
    Dec 13, 2011 at 17:48
  • 4
    @ekaj Depends on the type of encryption, AES 256 like used in kerberos exchanges (windows logins) is VERY difficult if not impossible to break.
    – Supercereal
    Dec 13, 2011 at 17:51
  • 1
    @ekaj Rainbow tables are fantastic for dealing with short hashes. They do not work well when dealing with much more than that. Brute forcing modern cryptography with a long key is hard. By which I mean be prepared to wait for months or years if you have a spare supercomputer lying around and expect to not see the answer in your lifetime if you don't.
    – TimothyAWiseman
    Dec 13, 2011 at 18:08
  • 2
    @ekaj define crack? If you mean you want to generate every possible 8 digit password, I suspect you could do it in much less than 22 days on a decent desktop. If you mean actually then try those to see which one decrypts your target file, that depends on how long each attempt takes, and that would take much longer. Also, 8 digits is not considered long for a strong password, and the difficult goes up exponentially with each extra character.
    – TimothyAWiseman
    Dec 13, 2011 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .