1

I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine?

I understand (and correct me if I'm wrong) that when logging in to a network managed by AD that an endpoint user will authenticate by way of Kerberos with the DC and the domain account database is stored on the DC. While an endpoint user will not have access to the SAM on their local machine due to some sort of security policy, a SAM exists, so I'm wondering what is actually stored in it?

1 Answer 1

0

I have done some research and gotten bits and pieces of information from various places that I have tried to piece together to try and form an answer to this. Here goes:

In AD managed environments the DC acts as the login verification server. When a user logs in their credentials are verified against the SAM held on the DC (by way of Kerberos). There is still a version of the SAM held on the endpoint machine which contains user information, security policies for user groups and also cached user credentials - this credentials for users that have previously logged into the machine. There is a security policy which can be set to determine the number of cached credentials called "Interactive logon: Number of previous logons to cache" with the default being 10. Obviously the DC SAM will contain user information for all users on the domain and the endpoint SAM will only contain information for users that have logged into that particular endpoint.

The purpose of keeping this information in the SAM on the local endpoint is usually to do with network availability. It's purpose is to still allow a user to log into the endpoint if the DC is not available (eg you have a poor network connection) or network efficiency in a low bandwidth environment (an example might be that the endpoint only verifies with the DC SAM for one login a day while all other logins are done from the endpoint SAM to save on bandwidth).

So in essence the endpoint SAM acts as a redundancy for the SAM stored on the DC to allow for connectivity issues or low bandwidth environments. This seems to be a bit of a security issue, but I guess this is how Windows works.

This is probably the best single source of information. I only found it once I discovered the existence security policy setting for "Interactive logon: Number of previous logons to cache".

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available

2
  • Adding references to the source info for this would be nice. I was sure that we had a question like this previously, but I couldn't find it. And I was also assuming that this info would be easier to find in the documentation, but it wasn't. So, if you could provide sources, this would be a great bit of work.
    – schroeder
    Oct 6, 2023 at 8:00
  • @schroeder Added a reference as you suggested. I also couldn't find anything on here and only found that documentation linked above once I discovered the existence of the Interactive Login policy setting and used that as the basis for my search. You would think this sort of thing would be easier to find. Oct 7, 2023 at 1:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .