Windows Security Account Manager

Passwords are a fundamental element of computer security, but researchers find they are involved in a large number of security vulnerabilities. However, you deserve to know how Windows is used by the security Account Manager or Sam to manage and execute passwords.

Windows Security Account Manager and password are very useful for any management enterprise desktop, here are five things you do not know:

1. The security Account manager has been a core part of Microsoft's operating system for many years and is now part of Windows 8.1. Sam's functionality is fixed in the Lsass.exe. Lsass.exe is a Windows service located in C:windowssystem32.

Windows Sam manages the local Windows account password and manages password validation during the logon process.

2. The Local Security Account Manager file (which is technically part of the Windows registry) is called a Sam, located in C:windowssystem32config. On a domain controller, the SAM file corresponds to the Active Directory database file Ntds.dit.

Figure 1

3. The SAM file is locked and cannot access the loaded operating system, as shown in Figure 1.

However, if the computer is started from a dynamic recovery disk such as Ophcrack, the computer is fully accessible. This is one of the main reasons why you need to encrypt corporate notebooks and desktop hard disks. However, if there are other weaknesses, Windows passwords may be exposed, so you cannot rely entirely on encryption.

4. Sam's backup file is located in C:windowssystem32repair. If the password is changed periodically, the expired password will be included in this file, but it is fully accessible to anyone who logs on to the computer. You only need to create an account on the machine to provide unauthorized (and irresponsible) access for someone with bad intent.

Figure 2

5. Store passwords in a SAM file using the new old LAN Manager (LM) hash or a more secure NTLM hash. Windows 7 and later versions default to NTLM hashes. These two types of hashes can be cracked using a rainbow table (Rainbow table). The Rainbow table is a technique for cracking hashing algorithms that was discovered 10 years ago by Philippe Oechslin of the Swiss Federal Institute of Technology. Oechslin's Ophcrack tool and ElcomSoft System Recovery are two famous tools for cracking Windows passwords using a predefined password hash. The options available in the ElcomSoft System recovery are shown in Figure 2.

Another good tool for extracting Windows password hashes from the SAM file is pwdump. Note that while Windows SYSKEY programs can be used to create more security in the Sam file, some tools such as ElcomSoft's proactive System Password recovery can break these controls.

The Windows Security Account Manager rarely has a problem. A local account may or may not be in your management category. However, it is worthwhile to know the details of when, where, and how to work.

In view of all this, I can say with certainty that as long as the Windows password-related, is not really safe. There is nothing like a precious asset--the user's password--so fragile. Do what you can to ensure that the risk is minimized.