up vote 5 down vote favorite
share [g+] share [fb]

Where are Microsoft Windows 7 passwords and credentials stored on disk?

I would like to physically verify that the Users group does not have access to files containing system passwords.

link|improve this question
83% accept rate
feedback

2 Answers

up vote 6 down vote accepted

Windows account details are stored in the SAM registry hive. It stores passwords using a one-way-hash (either LM Hash, which is old and weak, or NTLM hash which is newer and stronger.)

The SAM hive file is located at %WinDir%\system32\config\sam. This directory, and it parents, are by default inaccessible to non-administrative users. However it is vulnerable to offline attacks (e.g. booting a LiveCD and manually modifying the binary data. For example with the ONTPRE tool.)

link|improve this answer
feedback
up vote 2 down vote

They are stored per user in C:\users\username\AppData\Roaming\Microsoft\credentials and also in C:\users\username\AppData\Roaming\Microsoft\Vault . Since this is in a user directory it's safe to say only the user and computer/domain admins have access to it. Not to mention it is also encrypted.

link|improve this answer
"It's encrypted" is really all that needs to be said for your peace of mind, I should hope :) – Shinrai Dec 13 '11 at 17:36
1  
Encryption isn't hard to break with some reading on the net - I found this out earlier this year at school – ekaj Dec 13 '11 at 17:39
support.microsoft.com/kb/102716 I hate you people for beating me to this answer. Unless I was gunna answer it wrong in which case, thanks :) – OG Chuck Low Dec 13 '11 at 17:46
1  
Neither of these locations relate to where Windows stores user account passwords. – Amazed Dec 13 '11 at 17:48
3  
@ekaj Depends on the type of encryption, AES 256 like used in kerberos exchanges (windows logins) is VERY difficult if not impossible to break. – Kyle Dec 13 '11 at 17:51
show 6 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.