I run a Windows server, is it possible to prevent user from enumerating user password hashes?

Also can someone explain how the hash dumping tools works? As I didn't find it with google

1 Answer 1


Hash dumping tools exploit access control weaknesses to gain access to the hashes (if you google SAM file you will find out more about it)

So to prevent used accessing it you need to implement access controls. If your users have admin rights they can access anything in the system so you need to ensure they have ordinary user accounts.

You also need to make sure your system is patched up to date, as a vulnerability may allow a tool to run with admin rights or otherwise gain access.

  • 2
    As a quick example: If the user runs as an administrator they can easily create a new service that runs as SYSTEM, then grant it SeBackupPrivilege and bypass all ACLs. Alternatively they can grant it SeDebugPrivilege and then inject a DLL into the smss.exe (session manager) process, and use it to call into the DPAPI and extract the in-memory NTLM hashes. In short: if your user is an administrator, they can do what they like with the machine.
    – Polynomial
    Nov 20, 2012 at 8:35
  • 1
    Also, if you do not use drive encryption or a password-protected BIOS that excludes CD/USB boot then the user can simply pop in a boot disk and grab the hashes thusly.
    – Sammitch
    Nov 21, 2012 at 18:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .