I'm going over some options a tweaker-program is presenting, and one of them is "Do not store your logon password on the disk". The logon username & password are stored on the disk where they can be found and retrieved by anyone.

Now, while unlikely that I ever have to deal with a hack to retrieve this information from my computer: should I do this and prevent windows from saving this data, how will I login at all?

Far as I remember, passwords are stored in the SAM database. If I remove them, what will windows check my login against?

EDIT: the program in question is Auslogics BoostSpeed

  • I challenge you to name that "tweaker program". – JdeBP Jun 16 '11 at 10:56
  • @JdeBP: Auslogics BoostSpeed 5 – KdgDev Jun 17 '11 at 10:20

The option is either complete bollocks or at best, is misleading. Obviously it has to be stored in some form or another or you couldn't log in. It used to be that by default the password was stored in hashed form in the SAM. Given admin access, you could read the hash and with enough cpu time, you could recover the password, especially if it was a weak password. There was an option introduced to encrypt the SAM using a key that you had to supply at boot time so at least if someone obtained access to the hard drive while the machine is off, they wouldn't have the key and couldn't retrieve the password.

  • The encryption option is available through syskey.exe. – grawity Jun 16 '11 at 8:21
  • 1
    ... or it could simply be being misread by WebDevHobo. (Can you find evidence of the existence of any such option as named in a tweaker program? I cannot.) It could, for example, be talking about the passwords used by WWW browsers to log on to WWW services and saved in password files on disc. – JdeBP Jun 16 '11 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.