Glossary
SysKey
The Windows feature that encrypts the SAM database on disk, and the 128-bit key behind it — the boot key scattered across four SYSTEM registry subkeys.
SysKey is the Windows feature, introduced in Windows NT 4.0, that encrypts
the on-disk SAM database so password hashes cannot simply be read out of the
hive. The key it uses is the 128-bit boot key (the terms are often used
interchangeably).
What does SysKey do? It mixes that key into the encryption of both SAM hashes
and LSA secrets, which is why decrypting either one
offline requires the SYSTEM hive as well. The key is not stored as a value —
it is hidden in the class names of four subkeys under
HKLM\SYSTEM\CurrentControlSet\Control\Lsa and reassembled with a fixed
permutation. The old interactive syskey.exe boot-password prompt was removed
in Windows 10 (it had been abused by "tech-support" scammers), but the
underlying encryption remains. See
how the Windows boot key works for
the full mechanism, and the boot key entry.