Time
4 hours 15 minutes
Difficulty
Beginner
CEU/CPE
4

Video Transcription

00:01
Hello. Welcome back. This morning we're realizing one off the windows for basic essentials. Their Windows race three. So far, we have covered the definition of the structure. I'm so high as we started the window faces the contents and root key title. A ski look on machine or a scale
00:19
the scale and proved King contains settings that relate to the local computer. Therefore, millions of keys under this key. Some security so far on Sister,
00:32
the security accounts manager or son is a priest to file even those anti on later worships. Eat authenticates local you several guns on our main controller. It still restores the minister account from the time it Wasa Server, which serves us the directory service is restore mode recovery account.
00:52
It's known that when those computers can be confused, Toby in a world group or joint ta domain in a work group is Computer holds his own son, which contains information about all its local users on group accounts.
01:06
It stores passwords in a cast for months in Ellen, hash on NTL and hash.
01:12
It seems the hash function. It's one way this provides so mention off security for the stories off the passwords.
01:19
The Sandra History File is located on the system at the System route in system to to Conflict Folder, but it's locked and cannot be moved or copied while Windows is running.
01:32
The main function of the security accounts manager is holding onto the past four years to Logan into the Windows account. When we try to look into the user account we knows will use a series of hash algorithms, so calculate a hash for the past four that were just fighting.
01:49
If the hash is equal to a bus for harsh inside the San Francisco file, we must will allow you to looking.
01:55
Otherwise, we'll get this ever missus that the user name or password is incorrect.
02:00
The Sandra History file it's more accessible was your birthing system is putting up. This is why most off Windows password cracking so far? Concerts A Buddha? Will I So much
02:12
if we could be the some five Dexter, no media. Then we will be able to crack the password store in the side file with specialized tool, such a sum parts or off crack.
02:23
But he usually takes a very long time to crack the passport, especially if the past four is long and complicated.
02:30
The security key contains information about local security and user rights. Ah kuk. If the Sun Ki is also found in the security key
02:40
US with some, the security key is not accessible. You singer sourced editors On again, it's best manners. Using a Mr Tools
02:49
Local security authority secrets are stored in an encrypted form in the Windows Racer in the ski local machine. Security Always say secrets Key.
03:00
Frankie Hasty. Local matching security policy Contains this world data necessary for accessing on the creating the secrets.
03:08
Ellis. A Secret is a special protector. Stories for important data used by the local security authority in Windows. Essay is designed for money. Gina Systems Local security policy ordering authenticating Logan is Toronto system on a story Prayer data
03:27
Users on system sensitive data is stored in secrets
03:30
he access to all secret data is available to the system only
03:36
originally, the secrets contained cash domain records. Later, we lose developers expanded application area for the storage. At this moment, they can start users. This passwords Selby second passports. So just those that must be wrong by certain user to perform such a task.
03:53
A sentence for Bass Force Connection passwords.
03:57
Excuse Francisco Paris Force system account passports, Braille user data like a Christian Keys and a lot more.
04:05
The first key is the most commonly access for a streaky as it contains the settings for Windows on the sofa. Paralysis time on the computer
04:15
when a software program stalls there is Regent was so far so key to store application specific settings. Thes cities are loaded into a computer memory. It's time the computer system starts so that when a program is going by the user, they don't need to confuse the former game.
04:33
There are generally Kiss for easy style product, in which the approach store information Interim preferences configurations most recently used five lists. Another application modifiable items
04:47
this so far. Ki contains the Windows okey for some settings off the Windows User interface, a class of ski containing our historic association for five extensions and the policies Key us, organized by Bender for enforcing Turner uses policies on application on system service is
05:08
including the central certificate store
05:10
used for authenticating outta rising, or this how will remove systems or service is running outside the local network Domain
05:19
system contains information about all the hardware items in the system on information about the history itself. The Windows Boots loader. It's controls that information from the registry Qi Baishi Local Machine system, which is stored at the system Root system. Too little
05:39
conflict system
05:40
so that the colonel can determine which device drivers need to be lower it during the start off,
05:46
typically several countries that exists with the actual number, depending on how often system configuration settings change, the colonel creates the Priest Rickey s key local machine hearts work, which contains the Harvard data collected at systems. Start off
06:04
Windows supports an extensive set off devices with additional drivers provided bite hardware manufacturers.
06:14
Drivers are colonel. More features required by devices function within your operating system.
06:19
Service is our features. The support building system on application functions on acts as a network servers
06:28
service come running in a different context than use. Applications on typically do not offer many user can funeral options.
06:36
For example, the previous polar service is not required. I used her to be alone until the computer to run
06:44
our function independently off the user who is running to the sister.
06:47
Drivers generally communicate directly with the hardware device
06:51
we're a service is usually communicate with her were true drivers.
06:57
Driver and service fives are typically stored in the system route assistant a little on the sister wrote a system to the two drivers,
07:05
and they used that XY that sees or dll file name extensions.
07:12
Drivers are also service is. Therefore, during curtain initiation, the Windows boot loader used information stored in the key local machine system. Current culture said service is service name. Restore some keys to a term in both the drivers on service is to load
07:31
in the service names of keys. The start entry specifies Want to start? The service is
07:38
for your stunts that will use food, water, clothes, all the drivers for which start a Cyril, such as device drivers for hard. These controllers after execution, is transferred to the colonel. The colonel. Those drivers and service is for which start this one.
07:57
Here's the quick question for you.
07:59
Whiskey contains the settings for wing Goes on. The program's installed on the computer. Is it a security account manager or be security key?
08:09
Or maybe see the system key or the software key?
08:16
If you said the correct when I saw for permits is stalled day eyes reading to the so first key to store application specific settings.
08:26
That's useful. Don't forget to check the references, the supplementary material. For more information on the next video, we're going to cover some new highs in most recent versions of Windows.

Up Next

Windows Forensics and Tools

The Windows Forensics and Tools course focuses on building digital forensics knowledge of Microsoft Windows operating systems, as well as some compatible software or tools that can be used to obtain or process information in such systems.

Instructed By

Instructor Profile Image
Adalberto Jose Garcia
Information Security Analyst at Bigazi
Instructor