Security Accounts Manager (SAM)

The Security Accounts Manager (SAM) is stored in the key:

HKEY_LOCAL_MACHINE\SAM\SAM

Sub keys:

Name	Description
Domains	Built-in and account domains
RXACT

Values:

Name	Data type	Description
C	REG_BINARY

C value data

The C value data is variable of size and consists of:

Offset	Size	Description
0	2	Unknown (Format version?)
2	2	Unknown
4	4	Unknown (empty?)
8	4	Security descriptor data size
12	2	Unknown
14	2	Unknown
16	...	Security descriptor data