4

Possible Duplicate:
How are windows passwords handled?

can someone give me idea regarding how passwords are being stored inside the windows operating system?

Improve this question
5
  • 7
    Sure, want my credit card information too?
    – George
    Jan 19, 2011 at 18:07
  • 2
    What version of Windows? In a domain?
    – gbn
    Jan 19, 2011 at 18:07
  • 5
    That's a horrible title.
    – SLaks
    Jan 19, 2011 at 18:10
  • 1
    @George it's not terribly private. Everyone knows that your windows passwords are about as secure as your birthday. Ever heard of ophcrack?
    – Rafe Kettler
    Jan 19, 2011 at 18:12
  • 1
    Title changed to something a little more accurate
    – BBlake
    Jan 19, 2011 at 18:16

2 Answers 2

Reset to default
8

Normally, Windows store passwords on single computer systems in the registry in a hashed format using the NTLM algorithm. The registry file is located in 

C:\windows\system32\config\SAM.

This area of the registry has restrictive permissions so that a normal user cannot see the contents of HKLM\SAM deep enough to access the hash. In order to view the hashes one must change the permissions on the registry keys, this requires an administrative account on the system in Windows XP. I am unsure if access is possible using an administrator account in Vista or 7.

Once one has access to the password hashes though, it is difficult to gain the passwords again. There are many places on the internet that you can find information about brute forcing a NTLM hash. However, if you are simply trying to reset a password, I would recommend using Offline NT Password and Registry Editor.

If you want to get your arms wet though, the hash is stored under the key 

HKLM\SAM\SAM\Domains\Account\Users\00000XXX

with a value named V. The hash is stored at a variable offset that is stored at offset 0x9C and is a 4 byte little endian value.

Improve this answer
7

They are hashed using the NTLMv2 algorithm and stored in the SAM.

Improve this answer