Recipe 14.14 Preventing the LM Hash of a Password from Being Stored

14.14.1 Problem

You want to prevent the LM hash for new passwords from being stored in Active Directory. The LM hash is primarily used for backwards compatibility with Windows 95 and 98 clients. The LM hash is susceptible to brute force attacks.

14.14.2 Solution

For Windows 2000, you need to create the following Registry key on all domain controllers: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NoLMHash. Note that this is a key and not a value entry. Also, this is only supported on W2K SP2 and later domain controllers.

For Windows Server 2003, the NoLMHash key has turned into a DWORD value entry under the HKLM\SYSTEM\CurrentControlSet\Control\Lsa key. This value should be set to 1. You can accomplish this by modifying the Default Domain Controller Security Policy as described next.

14.14.2.1 Using a graphical user interface

1. Open the Default Domain Controller Security Policy snap-in.

2. In the left pane, expand Local Policies Security Options.

3. In the right pane, double-click on Network security: Do not store LAN Manager hash value on next password change.

4. Check the box beside Define this policy setting.

5. Click the Enabled radio button.

14.14.3 Discussion

If you do not have Windows 98 or older clients in your domain, you should consider disabling the storage of the LM password hash for users. The LM hash uses an old algorithm (pre-Windows NT 4.0) and is considered to be relatively weak compared to the NT hash that is also stored.

The LM hash is generated only for passwords that are shorter than 15 characters. So if you are one of the few people who have a password longer than this, the LM hash is not stored for you.

14.14.4 See Also

MS KB 299656 (How to Prevent Windows from Storing a LAN Manager Hash of Your Password in Active Directory and Local SAM Databases)