Is there some way to configure windows to place its SAM somewhere else rather than the default %systemroot%\system32\config\. May be it could be an additional security step.