Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. config
  5. SECURITY
FileRisk: Do not touch

SECURITY C:\Windows\System32\config\SECURITY

Registry hive HKLM\SECURITY: local security policy, LSA secrets and cached credentials. Access restricted to the system.

Updated on By AltF4 Formation

What it’s for

SECURITY is the hive that carries the local security policy. Windows loads it at startup and exposes it under HKEY_LOCAL_MACHINE\SECURITY. Only the system can open it: even an administrator cannot browse it in regedit without running as SYSTEM. The rules common to all hives are on the System32\config page.

What it contains

  • The local security policy: auditing, user rights and LSA security settings.
  • LSA secrets, such as service account passwords, and depending on configuration the cached domain credentials used for offline sign-in.
  • The companion transaction files (SECURITY.LOG1, SECURITY.LOG2), next to the hive.

Risks and best practices

  • This hive holds secrets. An offline copy, together with the SYSTEM hive, allows them to be extracted, so protect physical access and backups.
  • To change local policy, use secpol.msc or secedit, not the file.

Useful commands

Fenêtre de terminal
# The hive and its companion files (.LOG1, .LOG2, .regtrans-ms)
Get-ChildItem -Force "$env:windir\System32\config" -Filter "SECURITY*" | Select-Object Name, Length, LastWriteTime


# Export the local security policy for reading (as administrator)
secedit /export /cfg "$env:TEMP\secpol.inf"


# Offline copy of the hive (as administrator)
reg save HKLM\SECURITY "$env:TEMP\security.hiv"

Report a mistake