NTLM Authentication Password Storage Location
On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?
Community Insight
Tests knowledge of legacy Windows authentication mechanisms and their specific data stores, distinguishing between local SAM and domain AD databases.
Identifies the Security Accounts Manager (SAM) database as the correct storage location for NTLM password hashes on domain controllers. This page explains why SAM is the answer despite community debates favoring Active Directory.
Learners often select Active Directory or confuse it with Linux shadow files because they associate modern networks primarily with AD rather than NTLM-specific storage.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The question specifies an Active Directory network using NTLM authentication. While modern AD environments use Kerberos and store password hashes in theNTDS.dit file (Active Directory Database), NTLM is a legacy protocol that relies on the Security Accounts Manager (SAM) database to store password hashes. In a Domain Controller context, the SAM structure is integrated into the directory service, but technically, the hash retrieval mechanism for NTLM queries the SAM component. Therefore, 'SAM' is the standard textbook answer for where NTLM passwords are stored.Why the Other Options Are Wrong
- AMS: This is a distractor acronym with no relevance to Windows security architecture.
- Shadow file: This is used in Unix/Linux systems to store user password hashes, not in Windows environments.
- Password.conf: This is not a standard Windows system file or database for storing credentials.
Community Comment Notes
Community comments highlight a common confusion. One commenter correctly notes that SAM is the database storing usernames and passwords in Windows. Another argues that the Active Directory database (NTDS.dit) is the actual physical location, which is technically true for modern DCs, but exam questions often test the logical component (SAM) associated with the specific protocol (NTLM). A third comment simply validates option A as the correct choice based on the definition of SAM. Exam Strategy
Always distinguish between the authentication protocol (NTLM vs. Kerberos) and the storage mechanism when answering forensics questions. If the question mentions NTLM specifically, prioritize SAM over general AD references unless explicitly asked for the physical file name.
Frequently Asked Questions
Why isn't the Active Directory database the answer?
While NTDS.dit contains the data, the logical component handling NTLM credential verification is the SAM subsystem. Exams often target this distinction.
What is the difference between SAM and Shadow files?
SAM is the Windows database for local and domain account credentials. Shadow files are used in Linux/Unix systems for the same purpose.