The Security Accounts Manager (SAM) is the Windows database that stores local user accounts and groups. Microsoft’s definition, from its Learn article Credentials Processes in Windows Authentication, reads: “The Security Accounts Manager (SAM) is a database that stores local user accounts and groups.” The key idea is scope. A SAM account belongs to the one computer where it was created, while domain accounts are managed centrally in Active Directory.
What SAM stores
SAM holds two kinds of security principals on a Windows computer: users and groups. Microsoft’s auditing documentation names the object types involved as SAM_USER, SAM_GROUP, and SAM_ALIAS, where SAM_ALIAS refers to a local group. SAM management operations support creating, reading, updating, and deleting this security-principal information.
As an Amazon Associate I earn from qualifying purchases.
Each Windows computer has its own local account database. Microsoft’s protocol overview explains that these identities generally remain local because computers do not trust one another’s account information by default. A local account created on one workstation therefore does not automatically exist on another machine, even if both use the same username.
Free tools Windows power users keep installed
One-click scans. No signup required.
SAM does not store passwords in readable form. It stores password hashes for local user accounts. Domain-user cached credentials are a different mechanism: Windows keeps a separate verifier so a domain member can still validate a domain user when no domain controller can be reached. Cached credentials are not the same thing as a local account in SAM.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
SAM versus Active Directory
The distinction people most often need is between a local SAM account and a domain account. The table below uses only the differences that Microsoft’s documentation describes.
| Question | Local SAM account | Domain account |
|---|---|---|
| Where it is managed | In the SAM database of the individual computer | In Active Directory, on domain controllers |
| Scope | Limited to the computer where it was created | Usable across the domain, subject to Active Directory configuration |
| Trust between computers | Computers do not trust each other’s account information by default | Validated through the domain’s Active Directory authentication path |
| Password storage | Password hashes held in SAM | Not stored in a local SAM database on domain controllers; domain members keep a separate cached verifier |
Domain controllers use Active Directory for account access information rather than a SAM database. The sources cited here describe the difference in account stores and scope. They do not describe what happens to existing local accounts when a computer joins a domain, so avoid assuming that joining a domain removes local accounts.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Where SAM is stored
SAM is represented in the registry as the HKLMSAM hive (HKEY_LOCAL_MACHINESAM). Microsoft’s authentication overview states that a copy of the SAM database is stored in the registry and is protected from ordinary write access by the system. The same overview names the supporting files as Sam, Sam.log, and Sam.sav.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBecause the hive is system-protected, the practical way to understand SAM is through its role and its management interfaces, not by opening the hive to read account data. Expect restricted access if you try to browse it directly.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
How SAM fits into logon
The Local Security Authority (LSA) is the protected subsystem involved in local logon and security policy. Authentication then follows one of two paths:
- Local account logon: Windows validates the credentials against the local SAM database on that computer.
- Domain account logon on a domain-joined computer: Windows validates the domain credentials against Active Directory through the Windows logon and authentication path.
- Domain logon when no domain controller is reachable: Windows uses the cached domain credential verifier described above. This is not a SAM account lookup.
Auditing SAM
Microsoft’s Audit SAM guidance covers auditing attempts to access SAM objects, including user, group, alias, domain, and server objects. Changes to accounts are also recorded under Account Management auditing. However, the guidance warns that users with sufficient privileges can alter account or password files in ways that bypass those events, so Account Management auditing is not a complete record.
Rank #4
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
The same guidance does not recommend SAM-level auditing in general. It suggests enabling it only when you know exactly what you need to monitor, and it reports high event volume on domain controllers. This guidance was last updated on 2021-09-05. Check it against your Windows version and your current audit policy before treating it as current operational advice.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallLimits of this definition
The Microsoft documentation consulted defines SAM and describes its scope, storage, and auditing, but it does not provide prevalence, attack, or performance statistics for SAM. Any numeric claim about how often SAM is targeted or how it performs would need a separate authoritative source.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
