312-49 · Question #105
Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format. SAM file in Windows is located at:
The correct answer is A. C:\windows\system32\config\SAM. The Windows Security Accounts Manager (SAM) database is stored at C:\Windows\System32\config\SAM. It holds hashed credentials (NTLM/LM hashes) for local user accounts. The file is locked by the OS while Windows is running to prevent direct access. Attackers and forensic…
Question
Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format. SAM file in Windows is located at:
Options
- AC:\windows\system32\config\SAM
- BC:\windows\system32\con\SAM
- CC:\windows\system32\Boot\SAM
- DC:\windows\system32\drivers\SAM
How the community answered
(26 responses)- A92% (24)
- B4% (1)
- C4% (1)
Explanation
The Windows Security Accounts Manager (SAM) database is stored at C:\Windows\System32\config\SAM. It holds hashed credentials (NTLM/LM hashes) for local user accounts. The file is locked by the OS while Windows is running to prevent direct access. Attackers and forensic analysts often access it offline (e.g., via bootable media) or extract hashes using tools like fgdump or the Volume Shadow Copy service.
Topics
Community Discussion
No community discussion yet for this question.