nerdexam
EC-Council

312-49 · Question #650

In which registry does the system store the Microsoft security IDs?

The correct answer is D. HKEY_LOCAL_MACHINE (HKLM). Security Identifiers (SIDs) are stored within HKEY_LOCAL_MACHINE (HKLM). Specifically, local user account SIDs and password hashes reside in HKLM\SAM (Security Account Manager), and broader security policy data is stored in HKLM\SECURITY. HKLM contains system-wide configuration…

Submitted by stefanr· Apr 18, 2026Disk Forensics

Question

In which registry does the system store the Microsoft security IDs?

Options

  • AHKEY_CLASSES_ROOT (HKCR)
  • BHKEY_CURRENT_CONFIG (HKCC)
  • CHKEY_CURRENT_USER (HKCU)
  • DHKEY_LOCAL_MACHINE (HKLM)

How the community answered

(45 responses)
  • A
    2% (1)
  • B
    2% (1)
  • C
    4% (2)
  • D
    91% (41)

Explanation

Security Identifiers (SIDs) are stored within HKEY_LOCAL_MACHINE (HKLM). Specifically, local user account SIDs and password hashes reside in HKLM\SAM (Security Account Manager), and broader security policy data is stored in HKLM\SECURITY. HKLM contains system-wide configuration that applies to all users and is not dependent on which user is logged in. HKCU stores current user-specific settings, HKCC stores current hardware profile data, and HKCR stores file association and COM object registration data - none of which are the primary location for SID storage.

Topics

#Windows Registry#Security Identifiers (SIDs)#HKEY_LOCAL_MACHINE#System Internals

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-49 Practice