Search notes:

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users

The names of the subkeys of HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users correspond to the RID of a user or group.

Links

Lucien Oprea: Unveilling the password encryption process under Windows.

Index