Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 7 down vote favorite
2

Where are Microsoft Windows 7 passwords and credentials stored on disk?

I would like to physically verify that the Users group does not have access to files containing system passwords.

share|improve this question

2 Answers

up vote 7 down vote accepted

Windows account details are stored in the SAM registry hive. It stores passwords using a one-way-hash (either LM Hash, which is old and weak, or NTLM hash which is newer and stronger.)

The SAM hive file is located at %WinDir%\system32\config\sam. This directory, and it parents, are by default inaccessible to non-administrative users. However it is vulnerable to offline attacks (e.g. booting a LiveCD and manually modifying the binary data. For example with the ONTPRE tool.)

share|improve this answer
up vote 2 down vote

They are stored per user in C:\users\username\AppData\Roaming\Microsoft\credentials and also in C:\users\username\AppData\Roaming\Microsoft\Vault . Since this is in a user directory it's safe to say only the user and computer/domain admins have access to it. Not to mention it is also encrypted.

share|improve this answer
"It's encrypted" is really all that needs to be said for your peace of mind, I should hope :) – Shinrai Dec 13 '11 at 17:36
1  
Encryption isn't hard to break with some reading on the net - I found this out earlier this year at school – ekaj Dec 13 '11 at 17:39
support.microsoft.com/kb/102716 I hate you people for beating me to this answer. Unless I was gunna answer it wrong in which case, thanks :) – OG Chuck Low Dec 13 '11 at 17:46
1  
Neither of these locations relate to where Windows stores user account passwords. – Amazed Dec 13 '11 at 17:48
3  
@ekaj Depends on the type of encryption, AES 256 like used in kerberos exchanges (windows logins) is VERY difficult if not impossible to break. – Kyle Dec 13 '11 at 17:51
show 6 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.