nerdexam
GIAC

GCFA · Question #171

Which of the following Windows Registry key contains the password file of the user?

The correct answer is D. HKEY_LOCAL_MACHINE. HKEY_LOCAL_MACHINE contains the SAM subkey, which is the Windows registry location storing local user account password hashes.

File System & Registry Forensics

Question

Which of the following Windows Registry key contains the password file of the user?

Options

  • AHKEY_USER
  • BHKEY_CURRENT_CONFIG
  • CHKEY_DYN_DATA
  • DHKEY_LOCAL_MACHINE

How the community answered

(32 responses)
  • A
    3% (1)
  • B
    13% (4)
  • C
    3% (1)
  • D
    81% (26)

Why each option

HKEY_LOCAL_MACHINE contains the SAM subkey, which is the Windows registry location storing local user account password hashes.

AHKEY_USER

HKEY_USERS stores per-user environment preferences and profile settings for all currently loaded user profiles on the system, but does not contain the password or credential database.

BHKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG holds information about the active hardware profile used during the current boot session, such as display and printer configuration - not user credential data.

CHKEY_DYN_DATA

HKEY_DYN_DATA was a registry key found only in Windows 95/98 for dynamic plug-and-play data and does not exist in Windows NT-based operating systems, and never stored password information.

DHKEY_LOCAL_MACHINECorrect

HKEY_LOCAL_MACHINE houses the SAM (Security Account Manager) subkey at HKLM\SAM, which stores hashed credentials for all local user accounts on the system. This hive contains system-wide configuration including security data, making it the registry hive directly associated with the Windows password database.

Concept tested: Windows Registry SAM password database location

Source: https://learn.microsoft.com/en-us/windows/win32/sysinfo/hkey-local-machine

Topics

#Windows Registry#HKEY_LOCAL_MACHINE#password storage#registry hives

Community Discussion

No community discussion yet for this question.

Full GCFA Practice