How Could Standard Users Read the SAM in HiveNightmare?

Windows local accounts are stored in a database called the SAM (Security Accounts Manager). Physically, it is a registry hive file in %windir%\system32\config, which standard users should not be able to read.¹²

In July 2021, it was disclosed that on several versions of Windows 10, standard users could read the files in this folder. This was CVE-2021-36934, known as HiveNightmare or SeriousSAM. The read path was Volume Shadow Copies, which are created for restore points and similar purposes. For that reason, it was also a vulnerability that installing the fix alone did not resolve.³⁴

1. Overview

CVE-2021-36934 is a Windows elevation of privilege vulnerability published on July 20, 2021. Microsoft cites overly permissive access control lists (ACLs) on multiple system files, including the SAM database, as the cause, and states that an attacker who successfully exploited it could run arbitrary code with SYSTEM privileges.⁵⁴

Microsoft’s record at the time of publication listed exploitation as “No” and public disclosure as “Yes”. Its exploitability assessment was “Exploitation More Likely”. CISA later added it to the Known Exploited Vulnerabilities Catalog.⁵⁹

flowchart TB
    accTitle: How HiveNightmare leads to elevation of privilege
    accDescr: Shows the flow in which standard users get read permission on the SAM and other files, can read the copies if shadow copies exist, and this leads to elevation of privilege.
    A["Users have read permission on SAM and other files"] --> B{"Is there a shadow copy of the system drive?"}
    B -->|"No"| C["No path to read a copy"]
    B -->|"Yes"| D["Standard users can read the SAM in the copy"]
    D --> E["Password hashes and more can be extracted"]
    E --> F["Leads to execution with SYSTEM privileges"]

Figure 1: The wrong permissions and the shadow copies together created a path for reading the SAM.⁸⁴

In the diagram a solid line marks a relation that always holds and a dashed line marks a conditional one (the conditions are given per relation on the detail page). The full list of relations (12 in total, with evidence and certainty) and the definitions of the main concepts are collected on the knowledge map detail page (in Japanese). Data: JSON-LD / Turtle

2. Affected Systems

The versions Microsoft listed for the update are Windows 10 versions 1809, 1909, 2004, 20H2 and 21H1.¹⁰ The list added in a revision the day after publication also included Windows Server, but the revisions of July 23 and 27, 2021 removed it as not affected.⁷

Table: Updates and build numbers listed in MSRC’s machine-readable data.¹⁰

The attacker must be able to execute code on the target PC.⁴ The CVSS attack vector is also “Local”.⁵ On top of that, a Volume Shadow Copy of the system drive must exist. CERT/CC notes that some configurations have no shadow copies, but explains that if the system drive is larger than 128 GB, shadow copies are created automatically by Windows Update or by installing an MSI.⁸¹¹

flowchart TB
    accTitle: Conditions under which HiveNightmare works
    accDescr: Shows that it works on an affected Windows 10 version when the attacker can execute code and a shadow copy of the system drive exists.
    A{"Is it an affected Windows 10 version?"} -->|"Not affected"| X["Not affected"]
    A -->|"1809 to 21H1"| B{"Can the attacker execute code on the PC?"}
    B -->|"No"| Y["Cannot be targeted with this vulnerability alone"]
    B -->|"Yes"| C{"Is there a shadow copy of the system drive?"}
    C -->|"No"| Z["No read path"]
    C -->|"Yes"| D["The SAM copy can be read"]

Figure 2: It was a vulnerability for an attacker already running on the PC to raise their privileges.⁴⁸

3. Details

The SAM lives in a registry hive file

The registry is stored in files in units called hives. A hive is a group of keys and values loaded into memory when the system starts or a user logs on. Most of them are in %SystemRoot%\System32\Config: HKEY_LOCAL_MACHINE\SAM corresponds to a file named Sam, HKEY_LOCAL_MACHINE\Security to Security, and HKEY_LOCAL_MACHINE\System to System.¹

The SAM is a database that stores local user accounts and groups. When logging on with a local account, the LSA (Local Security Authority) validates the credentials by checking the SAM. Microsoft explains that the copy of the SAM in the registry and the local security policy are accessible only to the system.²

flowchart TB
    accTitle: How registry hives map to files
    accDescr: Shows that the SAM, Security and System hives under HKEY_LOCAL_MACHINE are stored in files of the same names in the Config folder under System32.
    A["HKEY_LOCAL_MACHINE"] --> B["SAM hive"]
    A --> C["Security hive"]
    A --> D["System hive"]
    B --> E["Files in the Config folder"]
    C --> E
    D --> E
    E --> F["Sam, Security, System"]

Figure 3: The contents of the SAM are stored on disk as files in the Config folder.¹

The Users group had read permission

According to CERT/CC, on affected Windows 10 systems the files in %windir%\system32\config granted the BUILTIN\Users group read and execute (RX) permissions. CERT/CC describes this as allowing users who are not administrators to read these files.³⁸

CERT/CC shows how to check by running the following command from a command prompt that is not elevated.¹²

icacls %windir%\system32\config\sam

On an affected system, the output includes BUILTIN\Users:(I)(RX). (I) means a permission inherited from the parent folder, and RX means read and execute access. On a system that is not affected, access is denied.¹²¹³

flowchart TB
    accTitle: Telling the state apart from the icacls result
    accDescr: Shows running icacls on the SAM file from a non-elevated prompt and telling the state apart by whether Users' read permission is shown or access is denied.
    A["Run icacls from a non-elevated prompt"] --> B{"Result"}
    B -->|"BUILTIN\Users:(I)(RX) is shown"| C["Affected state"]
    B -->|"Access is denied"| D["Not affected"]

Figure 4: Whether a system is affected is told apart from the result when run with standard user rights.¹²

Shadow copies became the read path

Even with the read permission in place, the conditions for exploitation include the presence of shadow copies. CERT/CC and CISA both explain that if a shadow copy of the system drive exists, standard users can read these files.⁸⁹

Hive files are loaded into memory at startup and are in use by the running Windows system.¹ The Volume Shadow Copy Service (VSS) is a mechanism that creates a consistent copy of a volume at a point in time, and the shadow copies it creates are read-only. Restore points also use this mechanism. Microsoft explains that backup applications also use shadow copies to read locked or running files.¹⁴¹⁵ It appears that what was read was not the live hive files but the same files preserved in a point-in-time shadow copy.¹⁶

flowchart TB
    accTitle: Live files and shadow copies
    accDescr: Shows that separately from the hive files used by the running Windows system, a shadow copy keeps the files and their permissions from a point in time as read-only.
    A["System drive"] --> B["Live hive files"]
    A --> C["Shadow copy (point-in-time copy)"]
    B --> D["In use by Windows"]
    C --> E["Files kept read-only"]
    E --> F["Permissions readable by Users are kept too"]

Figure 5: A shadow copy keeps the files as they were when it was created, permissions included.¹⁴¹⁷

Why the update alone did not fix it

The August 2021 update fixed the ACLs on specific system files, including the SAM. It did not, however, fix the ACLs on every file in %windir%\system32\config. Microsoft explains that this was to avoid unexpected behavior.¹⁸

What the update fixes is the permissions of the live files. Because shadow copies are read-only, shadow copies created before the update still contain files with the loose permissions.¹⁴⁴ CERT/CC explains that shadow copies newly created after the ACLs are fixed have the correct ACLs.¹⁷ That is why Microsoft says the vulnerability is not fully mitigated unless all shadow copies of the system volume are deleted after the update.⁴

As for why the update did not also delete them, Microsoft explains that it was to avoid deleting shadow copies of users’ data without their consent.¹⁸

flowchart TB
    accTitle: What remains in shadow copies before and after the update
    accDescr: Shows that the update fixes the ACLs of the live files, but shadow copies created before it keep files with loose ACLs, so the read path remains until they are deleted and recreated.
    A["Shadow copies created before the update"] --> B["Files with loose ACLs remain"]
    C["August 2021 update"] --> D["Fixes the ACLs of the live files"]
    D --> E{"Were the old shadow copies deleted?"}
    E -->|"No"| B
    E -->|"Yes"| F["New shadow copies have correct ACLs"]

Figure 6: The update fixed the live files, and deleting the old shadow copies was left to users.⁴¹⁸¹⁷

4. Impact

Microsoft states that an attacker who successfully exploited the vulnerability could run arbitrary code with SYSTEM privileges, install programs, view, change or delete data, and create new accounts with full user rights.⁴

CERT/CC lists the following possible impacts of being able to read these files.⁸

• Extracting and using account password hashes
• Discovering the original Windows installation password
• Obtaining the computer’s DPAPI keys and decrypting all of the computer’s private keys
• Obtaining a computer machine account and using it in a silver ticket attack

The impact does not necessarily stay inside that PC. Microsoft explains that local administrator accounts often share the same password across many devices, and that attackers exploit this to move laterally.¹⁹ If the password behind an extracted hash is also used for the local administrator on other PCs, the damage can spread beyond that PC.²⁰

flowchart TB
    accTitle: The impact that spreads from being able to read the SAM
    accDescr: Shows that being able to read the SAM and other files can lead to elevation of privilege on that PC and to lateral movement to other PCs that share the local administrator password.
    A["SAM and other files can be read"] --> B["Password hashes can be extracted"]
    A --> C["DPAPI keys and computer account information"]
    B --> D["Raise privileges on that PC"]
    B -.->|"if the same password is reused"| F["Lateral movement to other PCs"]

Figure 7: If local administrator passwords are reused, an elevation of privilege on one PC can spread to other PCs.⁸¹⁹

5. Mitigation

Apply the August 2021 update or later

First, apply the August 2021 security updates (KB5005030, KB5005031, KB5005033) or later to the affected versions.¹⁰⁷ As a workaround for systems that could not be updated, Microsoft advised running the following command from an elevated command prompt to restrict access to the contents of %windir%\system32\config.²¹

icacls %windir%\system32\config\*.* /inheritance:e

Whether you use the workaround or apply the update, that alone is not enough. Microsoft says that both restricting access and deleting the shadow copies are required.²¹

Delete the shadow copies after the update

KB5005357 shows the steps for listing and deleting the shadow copies of the system drive. Run both from an elevated command prompt.²²

vssadmin list shadows /for=%systemdrive%
vssadmin delete shadows /for=%systemdrive% /Quiet

After deleting, run vssadmin list shadows again; if it shows “No items found that satisfy the query.”, no shadow copies remain on the system drive.²²

Deleting them has consequences. Restore points that depend on the deleted shadow copies can no longer be used, and applications that use shadow copies directly also lose access to earlier restore points.¹⁵ Deleted shadow copies cannot be recovered.²³ Before deleting, you need to check which backups rely on shadow copies.

flowchart TB
    accTitle: Steps for deleting the shadow copies
    accDescr: Shows applying the update, listing the shadow copies and checking the impact, deleting them and confirming the list is empty, and creating a new restore point if needed.
    A["Apply the August 2021 update or later"] --> B["List the shadow copies"]
    B --> C["Check dependent restore points and backups"]
    C --> D["Delete the shadow copies"]
    D --> E{"Is the list empty?"}
    E -->|"Some remain"| F["Check what backup products manage"]
    E -->|"Empty"| G["Create a new restore point if needed"]

Figure 8: Create new restore points only after dealing with the vulnerability.²²²⁴

vssadmin delete shadows can delete only shadow copies of the client-accessible type. Other shadow copies are managed with diskshadow.²³ On Windows Server, shadow copies created by other backup products, such as wbadmin, must be managed within those products.²⁵

If you need a new restore point, create it after the deletion. KB5005357 shows that one can be created with PowerShell’s Checkpoint-Computer, and that it must be created only after dealing with the vulnerability.²⁴

Check the ACLs after restoring from a backup

Microsoft cautions that restoring a system from a backup can also restore the overly permissive ACLs and return it to the affected state. After a restore, you need to confirm that the ACLs are correct.²¹ The check is the same icacls command shown in an earlier section.

flowchart TB
    accTitle: Checking after restoring from a backup
    accDescr: Shows that restoring from a backup taken before the update can bring back loose ACLs, so after restoring you check the ACLs with icacls and redo the update and the shadow copy deletion if needed.
    A["Restore the system from a backup"] --> B["Check the ACLs with icacls"]
    B --> C{"Do Users have read permission?"}
    C -->|"No"| D["Not affected"]
    C -->|"Yes"| E["Apply the update again"]
    E --> F["Delete the shadow copies again"]

Figure 9: A restore can bring back the permissions from before the update.²¹

Use a different local administrator password on each device

It is not a measure the CVE-2021-36934 advisory asks for, but Windows LAPS is a way to limit how far the impact spreads. Windows LAPS regularly changes and stores the local administrator password for each device, and Microsoft lists protection against pass-the-hash and lateral-traversal attacks among its benefits.¹⁹ How to deploy it is explained in A Practical Guide to Windows LAPS.

flowchart TB
    accTitle: The overall mitigation for HiveNightmare
    accDescr: Shows applying the update, deleting the shadow copies and checking the ACLs after restores in order, with managing local administrator passwords added as a separate measure that limits how far the impact spreads.
    A["August 2021 update or later"] --> B["Delete the shadow copies"]
    B --> C["Check the ACLs after restores"]
    C -.->|"a separate measure that limits spread"| D["Use Windows LAPS for per-device passwords"]

Figure 10: Treat the three measures the advisory asks for separately from the measure that limits lateral movement.²¹¹⁹

6. Lessons

What follows are design and operational observations drawn from the published history and mitigations.

In HiveNightmare, even after the update fixed the permissions of the live files, the old permissions preserved in shadow copies were not fixed. A check of the ACLs is also required after a restore.⁴²¹ This suggests that when fixing the permissions of a file, you need to think about the mechanisms that hold copies of that file as well. Shadow copies and backups preserve not only the contents at the time they were made but also the permissions at that time.

Microsoft left the deletion of shadow copies to users in order not to delete users’ data without their consent.¹⁸ For vulnerabilities that need manual work after the update, a record that the update was applied is not enough to judge whether the system is protected. Check whether the advisory says “the update alone is not enough”, and add the remaining steps to your checklist.

What an attacker gained with this vulnerability was local elevation of privilege.⁵ Even so, if local administrator passwords are shared between devices, a hash extracted on one device may work on others as well.¹⁹ An elevation of privilege vulnerability looks like a single-PC problem, but whether each device uses different credentials determines how far the damage reaches.

This article explains the mechanism and the mitigations based on published primary sources. No operation to read files from shadow copies and no reproduction of the elevation of privilege was carried out.

Related Articles

• Volume Shadow Copy (VSS): The Mechanism and the Practice
• A Practical Guide to Windows LAPS
• The “Same PC” Is Not the Same Execution Environment
• NTLM and Kerberos Explained with Diagrams
• How Could PetitPotam Relay a Domain Controller’s Authentication to AD CS?

References

The footnotes on the body text, tables and figures, and the source links in the FAQ, lead to the sections and items of the supporting documents. Where an explanation was assembled from the documents or is a design observation, the footnote says so. All sources were checked on November 1, 2026.

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These are topic pages close to this theme. Starting from the article, you can go on to related services and other articles.

Services Connected to This Topic

This article leads to the following service pages. Start from the entry point closest to your situation.

Frequently Asked Questions

Questions commonly asked at the time of consultation about the topic of this article.

Is installing the August 2021 security update enough to deal with HiveNightmare?

No. Microsoft states explicitly that the vulnerability is not fully mitigated unless all shadow copies of the system volume are deleted manually after installing the update. The update fixes the permissions of the live files; the contents of shadow copies created before it do not change.

References

• MSRC CVE-2021-36934 (Simply installing this security update will not fully mitigate this vulnerability)

What stops working when the shadow copies are deleted?

Restore points that depend on the deleted shadow copies can no longer be used. Microsoft says this may also affect restores with third-party backup applications. On the other hand, it explains that backup applications that create backups without using shadow copies are not affected.

References

• KB5005357: Delete Volume Shadow Copies (potential impacts)
• MSRC CVE-2021-36934 Workaround (Impact of workaround)

How can I check whether my PC is in an affected state?

Run icacls %windir%\system32\config\sam from a command prompt that is not elevated. According to CERT/CC, an affected system includes BUILTIN\Users:(I)(RX) in the output; otherwise, access is denied. To check whether shadow copies exist, run vssadmin list shadows from an elevated command prompt.

References

• CERT/CC VU#506989 (To check if a system is vulnerable)

Is Windows Server affected too?

Microsoft's updates cover Windows 10 versions 1809 through 21H1 and do not include Windows Server. In revisions after publication, the Windows Server versions were removed from the list as not affected.

References

• MSRC CVE-2021-36934 revisions (Removed Windows Server versions)

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and bug investigation, with particular strength in projects where existing assets remain and in investigating failures whose cause is hard to see.