dcSAM

dcSAM, short for Domain Controller Security Accounts Manager, is a term used in Windows security to describe the subsystem that handles security account data on a domain controller. It represents the set of components and interfaces that integrate domain accounts with the local security policy, authentication flows, and policy enforcement in an Active Directory environment. In practice, dcSAM is part of the security stack that coordinates with the Local Security Authority (LSA), the Netlogon service, and Active Directory Domain Services (AD DS) to support logon and access control.

Operationally, domain controllers rely on the dcSAM interfaces during authentication, which may involve Kerberos authentication for domain users and, when necessary, NTLM as a fallback. The domain controller maintains credential material and access-control data that are critical to the domain's security, and the dcSAM surface is tightly protected. Direct access to the underlying credential storage is restricted, and best practices emphasize limiting administrator access to domain controllers, enforcing robust auditing, and applying defense-in-depth measures.

Security researchers and incident responders sometimes reference dcSAM when discussing credential theft techniques that target domain controller data. Because domain controllers hold sensitive material, compromise scenarios often involve attempts to dump or extract credentials via the DC SAM/LSA interfaces, highlighting the need for proactive monitoring, timely patching, and hardening of DCs. There is limited official Microsoft documentation that uses the term dcSAM in detail; it is more commonly encountered in security analyses, forensic reports, and defensive guidance.