You could simply just look.

HKLM\System\CurrentControlSet\Control\Lsa\NoLMHash The "NoLMHash" is a key
not a value.

Dave

>> -----Original Message-----
>> From: Brad Judy [mailto:judy (at) colorado (dot) edu [email concealed]]
>> Sent: Friday, February 07, 2003 11:42
>> To: 'dave'; 'Chris Mawer'; focus-ms (at) securityfocus (dot) com [email concealed];
>> honeypots (at) securityfocus (dot) com [email concealed]
>> Subject: RE: L0phtCrack and Windows 2000 LM Hashes
>>
>> > >> My win2k box shows that three user-accounts on my windows 2000
>> > >> machine report as being *empty*, <8 and 2 of the three
>> > share a NULL
>> > >> password LM Hash of AAD3B435B51404EEAAD3B435B51404EE. The
>> > third hash
>> > >> is different and I do not wish to report it here for what id deem
>> > >> obvious reasons.
>> >
>> > This hash means there is no LM hash store which is good. This
>> > means the NOLMhash key exists.
>> >
>> > The one that does show a different one just change the
>> > password, it only takes effect once the password is changed.
>> > It then should show AAD3B435B51404EEAAD3B435B51404EE like the others.
>> >
>> > Dave
>>
>> Or it simply means that LM is not disabled, but these two accounts have
>> 15+ character passwords.
>>
>> Brad Judy
>>

[ reply ]