Possible Duplicate:
How are windows passwords handled?
can someone give me idea regarding how passwords are being stored inside the windows operating system?
Possible Duplicate:
How are windows passwords handled?
can someone give me idea regarding how passwords are being stored inside the windows operating system?
Normally, Windows store passwords on single computer systems in the registry in a hashed format using the NTLM algorithm. The registry file is located in
C:\windows\system32\config\SAM.
This area of the registry has restrictive permissions so that a normal user cannot see the contents of HKLM\SAM
deep enough to access the hash. In order to view the hashes one must change the permissions on the registry keys, this requires an administrative account on the system in Windows XP. I am unsure if access is possible using an administrator account in Vista or 7.
Once one has access to the password hashes though, it is difficult to gain the passwords again. There are many places on the internet that you can find information about brute forcing a NTLM hash. However, if you are simply trying to reset a password, I would recommend using Offline NT Password and Registry Editor.
If you want to get your arms wet though, the hash is stored under the key
HKLM\SAM\SAM\Domains\Account\Users\00000XXX
with a value named V
. The hash is stored at a variable offset that is stored at offset 0x9C
and is a 4 byte little endian value.