Import from Local Machine

Parent Previous Next

To import password hashes from a local machine, you must be logged in with administrator rights or have an administrator/password pair. The local machine import works regardless of whether passwords are stored in a SAM file or in an Active Directory.

First, select Import from local Windows system. You can select to Keep Currently Imported Accounts if you are adding this import to accounts (hashes) you have already imported. If this option is not selected the import will overwrite any previously imported accounts. If you want to audit all system accounts, not just user accounts, you can select to Include Machine Accounts.

Next, specify the credentials that will be used to access the password hashes. You can choose Use Logged-In User Credentials. If you previously saved credentials for the local machine you can Use Saved Credentials. You can also select Use Specific User Credentials. If specific user credentials is selected you need to specify Username, Password, and optionally a Domain. You can select Save These Credentials to save the username, password, and domain to the Windows protected store for use in future audits. You are now ready to select your audit settings.