Editing Security Account Manager (section)

{{short description|Windows database that stores users' passwords}}
{{Multiple issues|
{{Technical|date=March 2012}}
{{More citations needed|date=September 2014}}
}}

The '''Security Account Manager''' ('''SAM''') is a database file<ref>{{cite web|title=Security Account Manager (SAM)|url=https://technet.microsoft.com/en-us/library/cc756748%28v=ws.10%29.aspx|work=TechNet|publisher=Microsoft|access-date=11 April 2014}}</ref> in Windows NT, Windows 2000, Windows XP, Windows Vista, Windows 7, 8.1, 10 and 11 that stores users' passwords. It can be used to authenticate local and remote users. Beginning with Windows 2000 SP4, Active Directory authenticates remote users. SAM uses cryptographic measures to prevent unauthenticated users accessing the system.

The user passwords are stored in a hashed format in a [[Windows Registry#Hives|registry hive]] either as an [[LM hash]] or as an [[NTLM hash]]. This file can be found in <code>%SystemRoot%/system32/config/SAM</code> and is mounted on <code>HKLM/SAM</code> and <code>SYSTEM</code> privileges are required to view it.

In an attempt to improve the security of the SAM database against offline software cracking, Microsoft introduced the SYSKEY function in Windows NT 4.0. When SYSKEY is enabled, the on-disk copy of the SAM file is partially encrypted, so that the password hash values for all local accounts stored in the SAM are encrypted with a key (usually also referred to as the "SYSKEY"). It can be enabled by running the [[syskey|<code>syskey</code>]] program.<ref>
{{cite web |title=How to use the SysKey utility to secure the Windows Security Account Manager database |url=http://support.microsoft.com/kb/310105|work=Support|publisher=Microsoft Corporation|access-date=12 April 2014}}
</ref> As of Windows 10 version 1709,  [[syskey|<code>syskey</code>]] was removed due to a combination of insecure security<ref>{{Cite web |last=Deland-Han |title=Syskey.exe utility is no longer supported - Windows Server |url=https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/syskey-exe-utility-is-no-longer-supported |access-date=2023-01-17 |website=learn.microsoft.com |language=en-us}}</ref> and misuse by bad actors to lock users out of systems.