SAM Account Policy

Local password and lockout settings, and the next RID the machine will give out.

Use it to read the local password and lockout rules in force, and tell from NextRID how many accounts were ever made.

SAM
Accounts and RDP

What It Is

The account policy sets the rules for local passwords and lockouts, such as the shortest password allowed and how many wrong passwords lock an account. Administrators set it under Account Policies in Group Policy or the Local Security Policy console. The SAM keeps the settings in force in the F value of its Account key. The same value holds NextRID, the number the next local account or group will get.

What It Proves

The F value shows the password and lockout settings in force when the hive was saved. NextRID shows how many RIDs the machine has handed out, deleted accounts included.

What It Does Not Prove

It holds the current settings only, so a change shows as a new value with no history. Event 4739 in the Security log records each change and who made it.

Where It Lives

SAM Account Policy lives in the SAM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SAM\Domains\Account (value F)

C:\Windows\System32\config\SAM

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you. All three come from the one F value, as a parser decodes it.

Values in SAM Account Policy, each with what it tells you
Registry Value	What It Tells You
`F: LockoutThreshold (parsed)` `REG_BINARY0`	Local accounts never lock, however many wrong passwords are tried. Repeated wrong passwords for support or alice would leave event 4625 in the Security log, but never a lockout.
`F: MinPasswordLength (parsed)` `REG_BINARY0`	Policy sets no minimum length, so nothing stopped support being given a short password. The SAM shows only that the rule allowed a weak one.
`F: NextRID (parsed)` `REG_BINARY1003`	The next account or group will get RID 1003, and support holds 1002. So nothing was made after support and then deleted.

How to Read It

F is packed binary, so parse it with the AccountPolicy source of Velociraptor's Windows.Forensics.SAM.Enriched. LockoutThreshold is the number of wrong passwords before an account locks, and 0 means accounts never lock. MinPasswordLength, PasswordHistoryLength and the password ages show how long and how fresh local passwords must be. NextRID is the next number to be given out. Compare it with the highest RID under Users to find accounts made and since deleted.

When Windows Writes It: When an administrator or Group Policy changes the password or lockout policy, and when a new account or group takes a RID.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Velociraptor, Registry Explorer, RECmd

Hunt It

The policy sits in the SAM hive and is not logged as it stands, so parse the hive, or read it with Velociraptor. The Security log records each change in event 4739, with Authentication Policy Change auditing on.

Sees Related ActivityDeviceLogonEvents

Shows the failures the policy should limit. It does not read the policy, which only the SAM hive holds.

KQLDefender XDR, Advanced hunting

// Failed sign-ins per account, which a lockout policy is there to limitDeviceLogonEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where ActionType == "LogonFailed"| summarize Failures = count(), First = min(Timestamp), Last = max(Timestamp) by AccountDomain, AccountName| order by Failures desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what SAM Account Policy shows.

SAM User Names and RIDsGives the highest RID in use, to compare with NextRID.
Policy Changed, Security Event 4739Not in the RegistryNames who changed the password or lockout policy, and when, which the F value does not keep.
Failed Logons, Security Event 4625Not in the RegistryShows the wrong passwords that a lockout threshold of 0 never stopped.

Sources

The facts on this page come from these public pages, which say more on each point.