Where are Microsoft Windows 7 passwords and credentials stored on disk?

I would like to physically verify that the Users group does not have access to files containing system passwords.


Windows account details are stored in the SAM registry hive. It stores passwords using a one-way-hash (either LM Hash, which is old and weak, or NTLM hash which is newer and stronger.)

The SAM hive file is located at %WinDir%\system32\config\sam. This directory, and it parents, are by default inaccessible to non-administrative users. However it is vulnerable to offline attacks (e.g. booting a LiveCD and manually modifying the binary data. For example with the ONTPRE tool.)


They are stored per user in C:\users\username\AppData\Roaming\Microsoft\credentials and also in C:\users\username\AppData\Roaming\Microsoft\Vault . Since this is in a user directory it's safe to say only the user and computer/domain admins have access to it. Not to mention it is also encrypted.

  • 2
    Encryption isn't hard to break with some reading on the net - I found this out earlier this year at school – cutrightjm Dec 13 '11 at 17:39
  • 4
    Neither of these locations relate to where Windows stores user account passwords. – Andrew Lambert Dec 13 '11 at 17:48
  • 4
    @ekaj Depends on the type of encryption, AES 256 like used in kerberos exchanges (windows logins) is VERY difficult if not impossible to break. – Not Kyle stop stalking me Dec 13 '11 at 17:51
  • 1
    @ekaj Rainbow tables are fantastic for dealing with short hashes. They do not work well when dealing with much more than that. Brute forcing modern cryptography with a long key is hard. By which I mean be prepared to wait for months or years if you have a spare supercomputer lying around and expect to not see the answer in your lifetime if you don't. – TimothyAWiseman Dec 13 '11 at 18:08
  • 2
    @ekaj define crack? If you mean you want to generate every possible 8 digit password, I suspect you could do it in much less than 22 days on a decent desktop. If you mean actually then try those to see which one decrypts your target file, that depends on how long each attempt takes, and that would take much longer. Also, 8 digits is not considered long for a strong password, and the difficult goes up exponentially with each extra character. – TimothyAWiseman Dec 13 '11 at 18:42

protected by Community Jul 12 '14 at 23:33

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.