\Registry\Machine
System
CurrentControlSet
Control
LSA
AccessProviders
ProviderOrder = REG_MULTI_SZ "Windows NT Access Provider"
Windows NT Access Provider
ProviderPath = REG_EXPAND_SZ %systemroot%\system32\ntmarta.dll