Windows Registry Knowledge Base: Domains

# Domains

The Security Accounts Manager (SAM) domains are stored in the key:

```
HKEY_LOCAL_MACHINE\SAM\SAM\Domains
```

Sub keys:

Name | Description
--- | ---
Account | user, group, and local group accounts.
Builtin | built-in local groups, such as the Administrators and Users groups, that are established when the operating system is installed.

Values:

Name | Data type | Description
--- | --- | ---
(default) | |

## Account or Builtin sub key

Sub keys:

Name | Description
--- | ---
Aliases |
Groups |
Users |

Values:

Name | Data type | Description
--- | --- | ---
F | REG_BINARY |
V | REG_BINARY |

### F value data

Offset | Size | Value | Description
--- | --- | --- | ---
0 | ... | | <mark style="background-color: yellow">**Unknown**</mark>

### V value data

The V value data consists of:

* 17 x user information descriptors
  * security descriptor
  * username
  * full name
  * comment
  * user comment
  * <mark style="background-color: yellow">**Unknown**</mark>
  * home directory
  * home directory connect
  * script path
  * profile path
  * workstations
  * hours allowed
  * <mark style="background-color: yellow">**Unknown**</mark>
  * LM hash (LANMAN)
  * NTLM hash
  * <mark style="background-color: yellow">**Unknown**</mark>
  * <mark style="background-color: yellow">**Unknown**</mark>
* user information data

#### User information descriptor

A user information descriptor is 12 byte of size and consists of:

Offset | Size | Value | Description
--- | --- | --- | ---
0 | 4 | | Data offset <br> The offset is relative to the end of the last user information descriptor
4 | 4 | | Data size
8 | 4 | | <mark style="background-color: yellow">**Unknown**</mark>

## Aliases sub key

Sub keys:

Name | Description
--- | ---
Members |
Names |
%RID% |

Where %RID% is the relative identifier (RID) which corresponds to the last sub authority of the SID.

### Aliases RID sub key

Values:

Name | Data type | Description
--- | --- | ---
C | REG_BINARY |

#### C value data

Offset | Size | Value | Description
--- | --- | --- | ---
0 | 4 | | The relative identifier (RID)
4 | 4 | | <mark style="background-color: yellow">**Unknown (empty values)**</mark>
8 | 4 | | Size of unknown data at offset 52
12 | 2 | 2 | <mark style="background-color: yellow">**Unknown: major format version ?**</mark>
14 | 2 | 1 | <mark style="background-color: yellow">**Unknown: minor format version ?**</mark>
16 | 4 | | Name string offset <br> Relative from offset 52
20 | 4 | | Name string size <br> Contains number of bytes
24 | 4 | | <mark style="background-color: yellow">**Unknown (empty values)**</mark>
28 | 4 | | Description string offset <br> Relative from offset 52
32 | 4 | | Description string size <br> Contains number of bytes
36 | 4 | | <mark style="background-color: yellow">**Unknown (empty values)**</mark>
40 | 4 | | SID array offset <br> Relative from offset 52
44 | 4 | | SID array size
48 | 4 | | SID array number of values
52 | ... | | Contains an https://code.google.com/p/libfwnt/wiki/SecurityDescriptor[NT security descriptor]
... | ... | | Name string <br> Contains an UTF-16 little-endian formatted string without end-of-string character <br> The data is stored using 4-byte alignment
... | ... | | Description string <br> Contains an UTF-16 little-endian formatted string without end-of-string character <br> The data is stored using 4-byte alignment
... | ... | | SID array <br> Contains Windows NT Security Identifiers (SIDs)

### Aliases Members sub key

Sub keys:

Name | Description
--- | ---
%SID% |

Where %SID% is the security identifier (SID) in the form of a string e.g. S-1-5.

#### Aliases Members SID sub key

Sub keys:

Name | Description
--- | ---
%RID% |

Where %RID% is the relative identifier (RID) which corresponds to the last sub authority of the SID.

## Groups sub key

Sub keys:

Name | Description
--- | ---
Names |
%RID% |

### C value data

Offset | Size | Value | Description
--- | --- | --- | ---
0 | 2 | 2 | <mark style="background-color: yellow">**Unknown: major format version ?**</mark>
2 | 2 | 1 | <mark style="background-color: yellow">**Unknown: minor format version ?**</mark>
4 | 4 | | The relative identifier (RID)
8 | 20 | | <mark style="background-color: yellow">**Unknown (empty values)**</mark>
28 | 2 | 2 | <mark style="background-color: yellow">**Unknown: major format version ?**</mark>
30 | 2 | 1 | <mark style="background-color: yellow">**Unknown: minor format version ?**</mark>
32 | 4 | | Name string offset <br> Relative from offset 68
36 | 4 | | Name string size <br> Contains number of bytes
40 | 4 | | <mark style="background-color: yellow">**Unknown (empty values)**</mark>
44 | 4 | | Description string offset <br> Relative from offset 68
48 | 4 | | Description string size <br> Contains number of bytes
52 | 4 | | <mark style="background-color: yellow">**Unknown (empty values)**</mark>
56 | 4 | | Group member array offset <br> Relative from offset 68
60 | 4 | | Group member array size <br> Contains number of bytes
64 | 4 | | Group member array number of values
68 | ... | | Contains a [security descriptor](https://github.com/libyal/libfwnt/blob/main/documentation/Security%20Descriptor.asciidoc)
... | ... | | Name string <br> Contains an UTF-16 little-endian formatted string without end-of-string character <br> The data is stored using 4-byte alignment
... | ... | | Description string <br> Contains an UTF-16 little-endian formatted string without end-of-string character <br> The data is stored using 4-byte alignment
... | ... | | Group member array <br> Contains 4-byte RID values

## Users sub key

Sub keys:

Name | Description
--- | ---
Names |
%RID% |

Where %RID% is the relative identifier (RID) which corresponds to the last sub authority of the SID.

### Users RID sub key

Values:

Name | Data type | Description
--- | --- | ---
F | REG_BINARY |
V | REG_BINARY |

#### F value data

Offset | Size | Value | Description
--- | --- | --- | ---
0 | 2 | 2 | <mark style="background-color: yellow">**Unknown: major version ?**</mark>
2 | 2 | 2 | <mark style="background-color: yellow">**Unknown: minor version ?**</mark>
4 | 2 | | <mark style="background-color: yellow">**Unknown: Extended data flags ?**</mark>
6 | 2 | | <mark style="background-color: yellow">**Unknown: Extended data size ?**</mark>
8 | 8 | | Last logon date and time (lastLogon) <br> Contains a FILETIME
16 | 8 | | <mark style="background-color: yellow">**Unknown (lastLogoff?)**</mark>
24 | 8 | | Password last set date and time (pwdLastSet) <br> Contains a FILETIME
32 | 8 | | Account expires date and time (accountExpires) <br> Contains a FILETIME, where 0x7fffffffffffffff represents Never
40 | 8 | | Last password failure date and time (badPasswordTime) <br> Contains a FILETIME
48 | 4 | | Relative identifier (UserId) <br> The relative identifier (RID) corresponds to the the last authority of the SID
52 | 4 | | Primary group identifier (PrimaryGroupId)
56 | 4 | | User account control flags (UserAccountControl)