Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I run a Windows server, is it possible to prevent user from enumerating user password hashes?

Also can someone explain how the hash dumping tools works? As I didn't find it with google

share|improve this question

1 Answer

up vote 5 down vote

Hash dumping tools exploit access control weaknesses to gain access to the hashes (if you google SAM file you will find out more about it)

So to prevent used accessing it you need to implement access controls. If your users have admin rights they can access anything in the system so you need to ensure they have ordinary user accounts.

You also need to make sure your system is patched up to date, as a vulnerability may allow a tool to run with admin rights or otherwise gain access.

share|improve this answer
2  
As a quick example: If the user runs as an administrator they can easily create a new service that runs as SYSTEM, then grant it SeBackupPrivilege and bypass all ACLs. Alternatively they can grant it SeDebugPrivilege and then inject a DLL into the smss.exe (session manager) process, and use it to call into the DPAPI and extract the in-memory NTLM hashes. In short: if your user is an administrator, they can do what they like with the machine. – Polynomial Nov 20 '12 at 8:35
Also, if you do not use drive encryption or a password-protected BIOS that excludes CD/USB boot then the user can simply pop in a boot disk and grab the hashes thusly. – Sammitch Nov 21 '12 at 18:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.