I run a Windows server, is it possible to prevent user from enumerating user password hashes?

Also can someone explain how the hash dumping tools works? As I didn't find it with google


Hash dumping tools exploit access control weaknesses to gain access to the hashes (if you google SAM file you will find out more about it)

So to prevent used accessing it you need to implement access controls. If your users have admin rights they can access anything in the system so you need to ensure they have ordinary user accounts.

You also need to make sure your system is patched up to date, as a vulnerability may allow a tool to run with admin rights or otherwise gain access.

  • 2
    As a quick example: If the user runs as an administrator they can easily create a new service that runs as SYSTEM, then grant it SeBackupPrivilege and bypass all ACLs. Alternatively they can grant it SeDebugPrivilege and then inject a DLL into the smss.exe (session manager) process, and use it to call into the DPAPI and extract the in-memory NTLM hashes. In short: if your user is an administrator, they can do what they like with the machine. – Polynomial Nov 20 '12 at 8:35
  • 1
    Also, if you do not use drive encryption or a password-protected BIOS that excludes CD/USB boot then the user can simply pop in a boot disk and grab the hashes thusly. – Sammitch Nov 21 '12 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.