Where and how is the password stored for the account associated with a Windows service?

Question

In HKLM\SYSTEM\CurrentControlSet\Services\MY-SERVICE-NAME there is the Object Name key which contains the name of the user, but I can not find the password.

I am trying to understand how DP API interacts with Windows services management and with the service process itself.

Thanks!

score 17 · Accepted Answer · answered May 19 '16 at 00:42

Passwords for Windows services are stored in the registry under:

HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\_SC_<ServiceName>

When you configure a Windows service to run as a different account, the Service Control Manager uses the LsaStorePrivateData function to store the password, and the corresponding LsaRetrievePrivateData function to retrieve it.

So it is reversible encryption of some kind, but sorry, the exact encryption algorithm and technique are not publically documented. And helping you further reverse engineer it would be fun, but not a good idea for me.

score 4 · Answer 2 · answered Jan 26 '18 at 05:47

4

While the actual encryption method may not be clear, accessing the data and requesting that the OS decrypt it on your behalf is a well-defined process - using PowerShell or the NirSoft LSASecretsView tool.

answered Jan 26 '18 at 05:47

Royce Williams

1,394
8
16

score 0 · Answer 3 · answered Aug 13 '21 at 04:01

Stumbled across this page when looking for the ADSync password for Azure AD Connect service.

For anyone else, to change the NT SERVICE\ADSync password, follow this guide as it's not straightforward:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-serviceacct-pass

Where and how is the password stored for the account associated with a Windows service?

3 Answers3