\Registry\Machine
   System
      CurrentControlSet
        Control
          LSA
            AccessProviders
              ProviderOrder = REG_MULTI_SZ "Windows NT Access Provider"
              Windows NT Access Provider
                ProviderPath = REG_EXPAND_SZ %systemroot%\system32\ntmarta.dll