Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. config
  5. SAM
FileRisk: Do not touch

SAM C:\Windows\System32\config\SAM

SAM: the HKLM\SAM Registry hive, the database of local accounts and groups and their password hashes. Locked while Windows runs.

Updated on By AltF4 Formation

What it’s for

SAM (Security Account Manager) is the hive of local accounts. Windows loads it at startup and exposes it under HKEY_LOCAL_MACHINE\SAM. It answers when you sign in with a local account, and when net user or lusrmgr.msc list the machine’s users. The rules shared by every hive (locking, copying, editing) are on the page for the System32\config folder.

What it contains

  • Local accounts (relative IDs such as 500 for Administrator, 501 for Guest), local groups and password hashes, encrypted with a key derived from the SYSTEM hive.
  • On a domain controller, domain accounts are in ntds.dit. The SAM only keeps the Directory Services Restore Mode (DSRM) account there.
  • Cached domain credentials are not here: they sit in the SECURITY hive.
  • The companion transaction files (.LOG1, .LOG2) may sit next to it.

Risks and best practices

  • The SAM and the SYSTEM hive together are enough to extract local account hashes offline. Encrypt the disk (BitLocker), protect physical access and restrict rights on backups, which contain both hives.
  • CVE-2021-36934 (“HiveNightmare” or “SeriousSAM”) let a standard user read the SAM through shadow copies. It has been fixed, and you can check with icacls: the BUILTIN\Users group must not appear in the file’s permissions.
  • To list or change local accounts, use Get-LocalUser, net user or lusrmgr.msc, never the hive.

Useful commands

Fenêtre de terminal
# File permissions: BUILTIN\Users must not be listed (CVE-2021-36934 check)
icacls "$env:windir\System32\config\SAM"


# List local accounts (supported method, without reading the hive)
Get-LocalUser | Select-Object Name, Enabled, LastLogon, SID


# The hive and its companion files (.LOG1, .LOG2, .regtrans-ms)
Get-ChildItem -Force "$env:windir\System32\config" -Filter "SAM*" | Select-Object Name, Length, LastWriteTime


# Offline copy of the hive (as administrator)
reg save HKLM\SAM "$env:TEMP\sam.hiv"

Report a mistake