Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I run a Windows server, is it possible to prevent user from enumerating user password hashes?

Also can someone explain how the hash dumping tools works? As I didn't find it with google

share|improve this question

Hash dumping tools exploit access control weaknesses to gain access to the hashes (if you google SAM file you will find out more about it)

So to prevent used accessing it you need to implement access controls. If your users have admin rights they can access anything in the system so you need to ensure they have ordinary user accounts.

You also need to make sure your system is patched up to date, as a vulnerability may allow a tool to run with admin rights or otherwise gain access.

share|improve this answer
As a quick example: If the user runs as an administrator they can easily create a new service that runs as SYSTEM, then grant it SeBackupPrivilege and bypass all ACLs. Alternatively they can grant it SeDebugPrivilege and then inject a DLL into the smss.exe (session manager) process, and use it to call into the DPAPI and extract the in-memory NTLM hashes. In short: if your user is an administrator, they can do what they like with the machine. – Polynomial Nov 20 '12 at 8:35
Also, if you do not use drive encryption or a password-protected BIOS that excludes CD/USB boot then the user can simply pop in a boot disk and grab the hashes thusly. – Sammitch Nov 21 '12 at 18:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.