To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN Manager hash value on next password change").
However, as the policy's label clearly mentions, it has no immediate effect to hashes already stored in various clients' SAM databases. Of course, each user will have to change his password in the next few weeks, and the NoLMHash policy will be enforced such that their new password's LM hash won't be stored anymore, but this isn't true for any other user who logged in on that same station in the past (think of IT staff, help-desk support, user who previously owned that same computer, etc.). These passwords will never be changed on that same workstation again, and thus are still vulnerable to LM hash reversal (or did I missed something?). Even if these reversed passwords are not valid anymore because of the rotation policy, an attacker could probably easily find a pattern among all users (if a given LM hash is reversed to, say, "Colorado$04-2014" and this password has expired, there's still a chance that this user's subsequent password has been set to something like "Colorado$07-2014").
My question is: is there a way (a command, a script, whatever) to find out if there still are LM hashes stored on a given computer? Said in another way, I would like to make sure that, on a given computer, only NTLMv2 hashes are stored.
Thanks for your help!
