Windows 2000 SAM Database in Standalone Mode

In Microsoft Windows 2000, the Security Accounts Manager (SAM) database serves as the central repository for local security administration when an operating system runs in standalone mode. This article explains the essential responsibilities of the SAM database in a non-domain environment, focusing on credential storage, local authentication, security identifier management, and system resource access control.

Core Function of the SAM Database

When Windows 2000 runs in standalone mode—configured as a workgroup member or an isolated workstation rather than part of an Active Directory domain—it has no access to a centralized directory service. Under these conditions, the SAM database functions as the sole authoritative source for all user and group accounts on that specific computer.

The database itself is stored as a protected registry hive located in the %SystemRoot%\System32\Config\SAM directory and is locked by the operating system during runtime to prevent direct access.

Primary Roles in Standalone Mode

  1. Local Account and Credential Storage
    The SAM database stores account names, descriptions, account states (enabled, disabled, or locked), and one-way cryptographic password hashes (both LM and NTLM hashes). Because there is no network domain controller, all accounts authorized to log into the machine locally must reside directly within this database.

  2. User Authentication
    During the interactive logon sequence, the Winlogon process and the Local Security Authority Subsystem Service (LSASS) communicate with the SAM database. LSASS generates a hash from the password supplied by the user and compares it against the stored hash in the SAM. If the hashes match and the account restrictions are satisfied, logon is granted.

  3. Security Identifier (SID) Generation and Assignment
    Every local account and group created in Windows 2000 receives a unique Security Identifier (SID) generated by the SAM. The database maps these SIDs to human-readable usernames and groups. When a user successfully authenticates, LSASS extracts the user's SID and any associated local group SIDs from the SAM to compile the user’s access token.

  4. Access Control Enforcement
    The access token generated via the SAM database governs what local files, folders, registry keys, and system services the user can access. The Windows 2000 Security Reference Monitor (SRM) compares the SIDs embedded within the user's token against the Discretionary Access Control Lists (DACLs) assigned to local objects.

Contrast with Domain Mode

In an Active Directory domain environment, Windows 2000 delegates user authentication and directory storage to NTDS.dit on domain controllers, limiting the local SAM database primarily to recovery functions and local administrative tasks. In standalone mode, however, the SAM database completely replaces the need for Active Directory, ensuring the machine operates as a fully self-sufficient, secure operating environment.