Glossary
LSA secrets
Secrets the Windows LSA keeps in the SECURITY hive — service passwords, the machine account, DPAPI keys and the cached-logon key — all decryptable offline with the boot key.
LSA secrets are credentials the Local Security Authority stores in the
SECURITY registry hive, under Policy\Secrets. They are encrypted with the
LSA key, which is itself derived from the boot key
held in the SYSTEM hive — so anyone with both hives can decrypt them offline.
Common entries include $MACHINE.ACC (the computer account password),
DPAPI_SYSTEM (the machine DPAPI keys), NL$KM (the key
protecting cached domain logons), and DefaultPassword (the cleartext
auto-logon password, when set). See
LSA secrets and cached domain credentials
for how the LSA key is recovered and each secret unwrapped.