Instead of using "that other" program you can use RunAsSys.exe, yet
another handy tool to run interactively under the System account.
RunAsSys.exe is available here:
http://assarbad.net/de/stuff/temp/ On
the english page
http://assarbad.net/en/stuff look for localsystem.zip.
These are free and "safe" to use for experienced users, keeping in
mind that you can do a lot of damage running as the System account,
things that you can't do even as an Administrator. When you launch
RunAsSys a Command prompt will open and run under the System account,
any programs or processes that you open from that command session will
also open with the same System account privileges.
The keys were there all the time, you were just not using the System
account to run Regedit and open the keys, that is why you weren't seeing
anything. The second SAM key is normal, HKEY_LOCAL_MACHINE\SAM\SAM key
is also mapped to the HKEY_LOCAL_MACHINE\SECURITY\SAM key. It goes
without saying that there is a very good reason for heaving these keys
hidden! There is nothing there for users to change and if the keys are
tampered with you might not be able to log back on to the machine.
Finally, you could simply have accessed and read the contents of the
keys by changing the permissions on the keys to give the Administrator
Read permissions, but once again, it is best not to change the
permissions unless you know what you are doing and you should return the
permissions to their defaults once done.
John