Windows SAM database

The Windows Security Account Manager (SAM) database stores user passwords in a hashed format: LM or NTLM hash

Refer to the following for more information:

SAM database | Windows

How to retrieve the NTLM hash?

1. hashdump command in a Metasploit's meterpreter shell