Password hashes are stored on a Windows machine in several locations. Sometimes only the system account has access, but because this is data at rest booting to an alternate OS or remotely access via a call with system rights could work.
Where could password hashes be stored on a Windows host? (choose four)
A) The registry
B) ERD
C) The SAM file
D) A repair file
E) In RAM

Question

Quizplus · Accepted Answer

All of these locations store credentials. Syskey is no help if the attacker knows how to use the right tool.

Password Hashes Are Stored on a Windows Machine in Several