Registry: HKEY_LOCAL_MACHINE\SECURITY

HKEY_LOCAL_MACHINE\SECURITY stores the Lsass policy database. This database contains local system security policy settings which controls, among others:

• which domains are trusted to authenticate logon attempts
• which users are allowed to access the system
• on what channels these users are allowed to access the system (interactive, network, service logons)
• which privileges are assigned to a user
• how users are audited
• logon information for cached domain logons and service logons

The values for HKEY_LOCAL_MACHINE\SECURITY are physically stored on the harddisk in the file %SystemRoot%\system32\config\SECURITY.

In order to see anything, SYSTEM privileges are needed (see also NT Autority\System). Such privileges can be gained for example with the Sysinternals tool PsExec.