I have read that modifying the NoLMHash value in the registry can prevent LM hashing, but I still can dump the hash after doing this.
What does this key do? How can I prevent LM password hash dumping in Windows 8 and 7?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The following is purely from memory and I have not checked to be able to provide a reference, but I seem to recall that the NoLMHash registry key prevents generation of LMhashes does not remove them.
The implication being NoLMHash is only 'effective' in a practical sense after an account password change, until then both hash types will persist.
You can't stop the dumping of the LM Hashes, what you can do is stop generating them, that is what the noLMHash key is for.
After you disabled the generation of the LM hashes you need to change the passwords on each account to force the SAM database information to be updated with only the NTLM Hash keys .
There are many ways of forcing the users to change their passwords (like setting the expiration date of all passwords to a nearby date), but that is more a political issue since it depends on the size of the organization and the kind of accounts you have around (i.e. Providers or application accounts that needs to be changed too)
Windows computers use two forms of hashing: LANMAN and NTLMv2. LANMAN hashes are backward compatible with Windows 95 and Windows 98 systems, and are laughably weak. NTLMv2 hashes are cryptographically stronger. Windows systems are capable of generating both kinds of hashes in order to be compatible with all old machines. The NoLMHash registry value disables the generation of the old LANMAN hashes, preventing systems from being backwards compatible - but that doesn't matter, because you shouldn't have had any Windows 95 boxes on your network in the last 15 years or so.
Any hashing scheme (NTLMv2 included) is susceptible to Pass-the-hash attacks.