NTLM Authentication Password Storage Location
Short answer
A The Security Accounts Manager (SAM) database stores the password hashes required for NTLM authentication on the domain controller.
Question
Key Takeaways
Tests knowledge of legacy Windows authentication mechanisms and their specific data stores, distinguishing between local SAM and domain AD databases.
Identifies the Security Accounts Manager (SAM) database as the correct storage location for NTLM password hashes on domain controllers. This page explains why SAM is the answer despite community debates favoring Active Directory.
Common mistake: Learners often select Active Directory or confuse it with Linux shadow files because they associate modern networks primarily with AD rather than NTLM-specific storage.
Expert Analysis
Why the Answer Is Correct
The question specifies an Active Directory network using NTLM authentication. While modern AD environments use Kerberos and store password hashes in the NTDS.dit file (Active Directory Database), NTLM is a legacy protocol that relies on the Security Accounts Manager (SAM) database to store password hashes. In a Domain Controller context, the SAM structure is integrated into the directory service, but technically, the hash retrieval mechanism for NTLM queries the SAM component. Therefore, 'SAM' is the standard textbook answer for where NTLM passwords are stored.
Why the Other Options Are Wrong
- AMS: This is a distractor acronym with no relevance to Windows security architecture.
- Shadow file: This is used in Unix/Linux systems to store user password hashes, not in Windows environments.
- Password.conf: This is not a standard Windows system file or database for storing credentials.
Community Comment Notes
Community comments highlight a common confusion. One commenter correctly notes that SAM is the database storing usernames and passwords in Windows. Another argues that the Active Directory database (NTDS.dit) is the actual physical location, which is technically true for modern DCs, but exam questions often test the logical component (SAM) associated with the specific protocol (NTLM). A third comment simply validates option A as the correct choice based on the definition of SAM.
Exam Strategy
Always distinguish between the authentication protocol (NTLM vs. Kerberos) and the storage mechanism when answering forensics questions. If the question mentions NTLM specifically, prioritize SAM over general AD references unless explicitly asked for the physical file name.
Frequently Asked Questions
Why isn't the Active Directory database the answer?
What is the difference between SAM and Shadow files?
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
aqeel1506 👍 1ser records are stored in the security accounts manager (SAM) database or in the Active Directory database. Each user account is associated with two passwords: the LAN Manager-compatible password and the Windows password. Each password is encrypted and stored in the SAM database or in the Active Directory database.
-
Elb 👍 1A < The Security Accounts Manager (SAM) is a database that stores usernames and passwords in Windows.
-
Dumas 👍 1Question is way off. The Active Directory database (NTDS.dit) is where Passwords are stored.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.