SAM Database files (Windows server / systems)

higherho

Hello All,

I am trying to refresh my memory on something. In Active directory when users gets created and all that their passwords are hashed and stored in the SAM database file. To my knowledge when Windows is online you cannot move or edit this file at all because the file system protects it. Could you view it as a domain admin? I remember in the past when I had to get back into a system that had no passwords left behind by the previous SA and the system was hosed I used backtrack and the system was offline and I used BT to crack the SAM database file.

So I know when the system is online you cannot move or edit the file but does windows allow domain / enterprise admins view the file? I guess I could log in a system and check but I wanted to make sure my logic was right.