Logo
RSS Feed

🏺 SAM

Created: 21.06.2023

This is about … .

File path 🛣️: C:\Windows\System32\config\SAM.

⚠️ This file cannot be edited through the RegEdit unless the admin grants you permissions (data marked with red are not accessible unless the admin grants access):

sam-hive-permissions

However, this file can be accessed on a dead-box system. ⚠️ Also, this file only stores local creds, not domain or Microsoft account credentials!

SAM is a database of files, and it stores all the information about all the users: login information, password hashes, and group information.

🛠 Registry Explorer (Eric Zimmerman’s tool) can collect all users from the SAM and Profile files and show them assembled. This data can be exported to Excel, for example.

References

Expand… Something here