Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Where are Microsoft Windows 7 passwords and credentials stored on disk?

I would like to physically verify that the Users group does not have access to files containing system passwords.

share|improve this question

3 Answers 3

up vote 16 down vote accepted

Windows account details are stored in the SAM registry hive. It stores passwords using a one-way-hash (either LM Hash, which is old and weak, or NTLM hash which is newer and stronger.)

The SAM hive file is located at %WinDir%\system32\config\sam. This directory, and it parents, are by default inaccessible to non-administrative users. However it is vulnerable to offline attacks (e.g. booting a LiveCD and manually modifying the binary data. For example with the ONTPRE tool.)

share|improve this answer

They are stored per user in C:\users\username\AppData\Roaming\Microsoft\credentials and also in C:\users\username\AppData\Roaming\Microsoft\Vault . Since this is in a user directory it's safe to say only the user and computer/domain admins have access to it. Not to mention it is also encrypted.

share|improve this answer
"It's encrypted" is really all that needs to be said for your peace of mind, I should hope :) –  Shinrai Dec 13 '11 at 17:36
Encryption isn't hard to break with some reading on the net - I found this out earlier this year at school –  ekaj Dec 13 '11 at 17:39
Neither of these locations relate to where Windows stores user account passwords. –  Andrew Lambert Dec 13 '11 at 17:48
@ekaj Depends on the type of encryption, AES 256 like used in kerberos exchanges (windows logins) is VERY difficult if not impossible to break. –  Kyle Dec 13 '11 at 17:51
@ekaj define crack? If you mean you want to generate every possible 8 digit password, I suspect you could do it in much less than 22 days on a decent desktop. If you mean actually then try those to see which one decrypts your target file, that depends on how long each attempt takes, and that would take much longer. Also, 8 digits is not considered long for a strong password, and the difficult goes up exponentially with each extra character. –  TimothyAWiseman Dec 13 '11 at 18:42


@Kyle: While the passwords are hashed and then stored in the directory, the password can often be recovered by using rainbow tables (up to 14 charecters). Even if the file containing the hashes is encrypted, the key used for the encryption must be stored somewhere on the drive and there has to be code refrenceing the location of that key so that the system can find the hash value when the user attempts to log on.

share|improve this answer

protected by Community Jul 12 '14 at 23:33

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.