Security Accounts Manager (SAM)

The Security Accounts Manager (SAM) is stored in the key:

HKEY_LOCAL_MACHINE\SAM\SAM

Sub keys:

Name Description
Domains Built-in and account domains
RXACT

Values:

Name Data type Description
C REG_BINARY

C value data

The C value data is variable of size and consists of:

Offset Size Value Description
0 2 Unknown (Format version?)
2 2 Unknown
4 4 Unknown (empty?)
8 4 Security descriptor data size
12 2 Unknown
14 2 Unknown
16 ... Security descriptor data

Format version

Value Description
1 Used in Windows NT 3.1
2 Used in Windows NT 3.5
3 Used in Windows NT 4
6 Used in Windows 2000
7 Used in Windows XP and later
9 Used in Windows Windows 11