How to access the SAM file in Windows 10

Question

In the past I have cracked Windows passwords with a Live Linux disk and navigating to the SAM file. In windows 10 it seems this information is stored on the cloud. Is there a way to find this locally on the machine?

Solution

The SAM hive still exists in Windows 10, and it's in the same place. For local non-Microsoft accounts, the format does not appear to have changed; the NTLM hash is still the 16 bytes before the last 8 bytes of the V value.

For accounts that sign in with a Microsoft account password, the CachedLogonInfo value contains the cached password (source). Unfortunately, it's not just an NTLM hash, so normal Windows hash cracking tools won't work on it. If that page is correct and the algorithm is indeed much stronger - which would make sense, since it would be very bad if an MS account password could be retrieved from a workstation - then cracking it would take an extremely long time considering the complexity requirements Microsoft puts in place.

Comments

[Joe]

Thanks for the source it was great and mostly what I was looking for. I possibly should have rephrased my question. Instead of cracking if I were to just delete the cached credentials would it unlock the system?

[Ben N]

@Joe I suspect that there's some other bookkeeping that identifies it as a Microsoft account. If you just need to get into the machine, you might use something like this approach to create a new administrative user.

[Joe]

Thanks again. I have seen that method before definitely a neat trick.