Security Accounts Manager

From Wikipedia, the free encyclopedia

The Security Accounts Manager (SAM) is a database stored as a registry file in Windows NT, Windows 2000, and later versions of Windows. It stores users' passwords in a hashed format (in an LM hash and an NTLM hash). Since a hash function is one-way, this provides some measure of security for the storage of the passwords.

In an attempt to enhance the security of the SAM database against offline software cracking, Microsoft introduced the SYSKEY utility in Windows NT 4.0. The SAM file cannot be moved or copied while Windows is running. However, it can be dumped, displaying the password hashes, which can then be subjected to brute-force attack.

Most versions of Windows can be configured to disable the calculation & storage of valid LM hashes when the user changes their password. This is the default setting in Windows Vista. Note: enabling this setting does not immediately clear the LM hash values from the SAM, but rather enables an extra function during password changes that will instead store a "dummy" value in the LM hash field location in the SAM. (This dummy value has no relationship to the user's password - it is the same value used for all user accounts.]

LM hashes cannot be calculated when the user chooses a password of over 14 characters in length. Thus, when a user sets a 15+ character password, the LM hash value is set to a "dummy" value as well.

However, particularly in Windows NT 3.51, NT 4.0 and 2000, there was a security flaw with SAM in which if the hash file was deleted from the hard drive, a user could log in as any account with no password. This flaw was corrected with Windows XP.

This article was originally based on material from the Free On-line Dictionary of Computing, which is licensed under the GFDL.

[edit] External links

v • d • e
Microsoft Windows components
Core
Management
tools
Applications
Games
Kernel
Services
File systems
Server
Architecture
Security
Compatibility