2

Suppose Alice logs into Windows machine M (which is part of an enterprise network managed through Active Directory). My understanding is that M will contact the domain controller to get Alice's password hash, store it in the local SAM or NTDS.dit, and use it to verify Alice's login. (Tell me if I got that wrong.)

How long is the password hash retained locally? Once added, does it stay there forever? Or does it get automatically deleted after a certain period; and if so, how long is that period?

(Motivation: I'm trying to understand the security risks of password hashes stored in the SAM.)

1

Your understanding isn't quite right. If a domain user is authenticating to a domain member server using Kerberos then their password hash won't be sent there. Kerberos only requires the hash to be sent to a domain controller, which maintains the domain account database. And technically the hash itself isn't even sent to the DC. Then Kerberos issues a service ticket to the user and the user sends that ticket to the member server to prove their identity. So user credentials are never added to the local server account database (SAM) due to logins.

Depending on whether you are worried about cached credentials being temporarily stored in memory on member servers there are some other scenarios where a user's password hash might be transmitted to that server. But password hashes will only ever exist in local account databases if they were specifically added with accounts created by an Administrator.

  • My interpretation (which could be wrong) is that @D.W. is asking about: (a) user of company laptop, in the office, logs into their account and is verified using the company's AD domain controller. (b) at home, off the corporate network, the user fires up the laptop and logs-in. With no connection to the AD DC, verification must be local. I believe the question is how long will the local verification continue working. – TripeHound Jun 20 at 9:15
  • Notice that this isn't exactly correct as there is credential caching in the SAM even for domain accounts by default to enable local login when disconnect from the domain controller. – Jonathan Allon Jun 20 at 14:09
  • @JonathanAllon Credentials can be cached by a host after a local login, but even those aren't stored in the SAM. – PwdRsch Jun 20 at 16:22
  • My mistake. stored in the hklm/security/cache key, not technically part of the SAM. – Jonathan Allon Jun 20 at 21:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.