GCIH · Question #432
A sysadmin would use SYSKEY to accomplish which objective?
The correct answer is A. Apply encryption to locally stored password hashes. SYSKEY is a Windows utility that applies an additional layer of encryption to the SAM database, where local password hashes are stored on disk.
Question
A sysadmin would use SYSKEY to accomplish which objective?
Options
- AApply encryption to locally stored password hashes
- BRemove LANMAN hashes from a system
- CProtect hashes when they are in local memory
- DEnforce salted hashes of locally stored passwords
How the community answered
(47 responses)- A89% (42)
- B2% (1)
- C6% (3)
- D2% (1)
Why each option
SYSKEY is a Windows utility that applies an additional layer of encryption to the SAM database, where local password hashes are stored on disk.
SYSKEY (System Key) encrypts the SAM (Security Account Manager) database stored locally on a Windows system, adding a boot-time or floppy-key encryption layer over the password hashes. This prevents offline attacks against the SAM file by ensuring the hashes cannot be read without the system key. It specifically targets hashes at rest on disk, not in memory or their algorithmic format.
Removing LANMAN hashes is accomplished through Group Policy (Network Security: Do not store LAN Manager hash value) or registry settings, not SYSKEY.
SYSKEY protects hashes stored on disk in the SAM database - protecting hashes in memory is a separate concern addressed by tools or mitigations like Credential Guard.
SYSKEY encrypts the hash storage container, it does not change the hashing algorithm or add salting to the hash generation process.
Concept tested: SYSKEY SAM database encryption on Windows
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/syskey-utility-and-sam-database-security
Topics
Community Discussion
No community discussion yet for this question.