SAM — Security Accounts Manager

The Security Accounts Manager is the gatekeeper of local identity on every Windows system. Every local user account, every NTLM password hash, every logon timestamp, and every group membership lives in this single registry hive — encrypted behind the system boot key but fully recoverable with the right tools and the SYSTEM hive.

What Is the SAM Hive?

The Security Accounts Manager (SAM) is a registry hive that stores the local user account database on every Windows installation from NT 3.1 (1993) through Windows 11. It contains one entry per local account under SAM\Domains\Account\Users, each identified by a Relative Identifier (RID). The default Administrator account always receives RID 500, Guest receives 501, and user-created accounts begin at 1000. Each account entry stores the username, NTLM password hash (in the V value), account creation date, last logon time, logon count, failed logon count, password last set timestamp, and account flags such as disabled, locked, or password-never-expires.

The SAM hive is loaded into the HKLM\SAM registry subtree at boot time. It is locked by the operating system while Windows is running — direct file access is denied to all processes including those running as SYSTEM. The password hashes stored within are double-encrypted: first with a per-account key derived from the user RID (the DES layer), then with the system boot key extracted from the SYSTEM hive. Without both the SAM and SYSTEM hives, hash extraction is not possible.

Domain-joined machines still maintain a local SAM. Domain accounts are authenticated against the domain controller (stored in ntds.dit), but any local accounts — including the built-in Administrator, service accounts, and break-glass accounts — remain in the SAM. Lateral movement investigations frequently reveal that attackers extracted the SAM to harvest local administrator credentials that were reused across the fleet.

Location & Format

File Paths

Internal Structure

The SAM hive is a standard Windows registry hive file (regf format). Its internal structure follows a fixed hierarchy rooted at SAM\Domains\Account. Two key subtrees contain the forensic data: Users (per-account entries keyed by RID in hexadecimal) and Names (username-to-RID mappings). Each user entry contains two critical binary values: F (fixed-length metadata including timestamps and flags) and V (variable-length data including the username string and encrypted password hashes).

What It Reveals

Forensic Use Cases

Backdoor Account Detection

After gaining initial access, adversaries frequently create local accounts for persistence. The SAM records the exact account creation timestamp in the F value. By comparing account creation times against the known timeline of the intrusion, investigators can identify accounts created by the attacker. A local account created at 03:17 AM on the date of initial compromise, with the password-never-expires flag set and membership in the local Administrators group, is a high-confidence indicator of persistence.

Credential Theft Investigation

When an attacker extracts the SAM hive (via reg save, Volume Shadow Copy access, or tools like mimikatz), they obtain NTLM hashes that enable pass-the-hash attacks across the network. The SAM itself does not record that it was copied, but correlating evidence includes: Event ID 4688 showing reg.exe save HKLM\SAM, Prefetch entries for mimikatz.exe or secretsdump.py, and file system artifacts ($MFT, $UsnJrnl) showing SAM copies in staging directories.

Password Reuse Analysis

Extracting NTLM hashes from multiple systems and comparing them reveals password reuse. If the local Administrator account on 47 workstations shares the same NTLM hash, a single compromised credential gives the attacker lateral movement across the entire fleet. This analysis is performed by extracting hashes from each SAM/SYSTEM pair and grouping by hash value.

Insider Threat — Account Manipulation

Insiders with local admin rights may enable the disabled Guest account, remove password requirements, or add accounts to privileged groups. The SAM records the current state of all flags, and Volume Shadow Copies preserve historical states. Comparing the SAM across VSS snapshots reveals exactly when an account was enabled, when its flags changed, and when group memberships were modified.

Acquisition Methods

Live System — Volume Shadow Copy

:: Create a shadow copy to bypass OS file lock
vssadmin create shadow /for=C:

:: Copy SAM and SYSTEM from the shadow copy
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Evidence\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Evidence\

:: Alternative: reg save (requires SYSTEM privileges)
reg save HKLM\SAM C:\Evidence\SAM
reg save HKLM\SYSTEM C:\Evidence\SYSTEM

Live System — KAPE Collection

:: KAPE target collects SAM, SYSTEM, SECURITY, SOFTWARE, DEFAULT
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target RegistryHives

:: Or use RawCopy to bypass NTFS locks directly
RawCopy.exe /FileNamePath:C:\Windows\System32\config\SAM /OutputPath:C:\Evidence\
RawCopy.exe /FileNamePath:C:\Windows\System32\config\SYSTEM /OutputPath:C:\Evidence\

Forensic Image — Direct Extraction

# Mount the forensic image (read-only)
mount -o ro,noexec,nodev /dev/sdb1 /mnt/evidence

# Copy SAM and SYSTEM hives
cp /mnt/evidence/Windows/System32/config/SAM /analysis/sam/
cp /mnt/evidence/Windows/System32/config/SYSTEM /analysis/sam/

# Also grab RegBack copies if they exist
cp /mnt/evidence/Windows/System32/config/RegBack/SAM /analysis/sam/SAM.regback 2>/dev/null
cp /mnt/evidence/Windows/System32/config/RegBack/SYSTEM /analysis/sam/SYSTEM.regback 2>/dev/null

Parsing Tools & Analysis

Hash Extraction with secretsdump.py

# Extract NTLM hashes from offline SAM + SYSTEM hives
secretsdump.py -sam /analysis/sam/SAM -system /analysis/sam/SYSTEM LOCAL

# Output format: username:RID:LMhash:NThash:::
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# svc_backup:1001:aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42:::

Account Metadata with RegRipper

# Run the samparse plugin against the SAM hive
rip.pl -r /analysis/sam/SAM -p samparse

# Output includes per-account:
# Username, Full Name, Account Created, Last Login
# Password Last Set, Login Count, Failed Login Count
# Account Flags (Disabled, Locked, PW Never Expires, etc.)
# Group Memberships (Administrators, Remote Desktop Users, etc.)

Sample Output — Backdoor Account Detection

Username        : svc_backup
Full Name       :
Account Created : 2026-02-14 03:17:42 UTC
Last Login      : 2026-02-14 03:18:01 UTC
Pwd Last Set    : 2026-02-14 03:17:42 UTC
Login Count     : 1
Failed Logins   : 0
Flags           : Password does not expire | Normal account
Groups          : Administrators, Remote Desktop Users

Retention & Persistence

Boot Key & Encryption

SAM password hashes are not stored in cleartext. The encryption scheme uses a two-layer approach that requires the SYSTEM hive to decrypt:

• Layer 1 — Boot Key (SysKey): The 128-bit boot key is derived from four registry values in the SYSTEM hive: JD, Skew1, GBG, and Data under SYSTEM\CurrentControlSet\Control\Lsa. The key is obfuscated by distributing its bytes across the class names of these keys in a scrambled order.
• Layer 2 — Per-Account Key: Each account’s hash is further encrypted using the account’s RID as a DES key derivation input. This means identical passwords on accounts with different RIDs produce different encrypted values in the SAM.
• Windows 10 1607+ (AES): Modern systems use AES-128-CBC instead of the legacy RC4/DES scheme. The encryption algorithm is indicated by a revision field in the SAM structure. Tools like secretsdump.py automatically detect and handle both schemes.

Anti-Forensics Resilience

The SAM hive is a system-critical file protected by the operating system. It is locked while Windows is running and resides in a privileged directory. Standard cleanup tools do not target it.

MITRE ATT&CK Detection Mapping

The SAM hive provides evidentiary support for detecting the following MITRE ATT&CK techniques:

Related Artifacts & Cross-References

Corroborating Artifacts

References

1. Impacket Project, “secretsdump.py” — https://github.com/fortra/impacket
2. Harlan Carvey, “RegRipper — samparse plugin” — https://github.com/keydet89/RegRipper3.0
3. Benjamin Delpy, “mimikatz — lsadump::sam” — https://github.com/gentilkiwi/mimikatz
4. Eric Zimmerman, “Registry Explorer” — https://ericzimmerman.github.io/
5. Microsoft, “Security Accounts Manager” — https://learn.microsoft.com
6. SANS Institute, “Windows Forensic Analysis — SAM Hive” — https://www.sans.org/posters/windows-forensic-analysis/
7. 13Cubed, “SAM, SYSTEM, and SECURITY Hive Analysis” — https://www.13cubed.com
8. MITRE ATT&CK, “T1003.002: OS Credential Dumping: SAM” — https://attack.mitre.org/techniques/T1003/002/