I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved.
After an interactive logon with kerberos, you will have in the cached credentials both kerberos tickets and ntlm hashes. I figured winlogon/lsass are responsible for calculating the NTHash from the plain password and saving it to lsass memory regardless of the kerberos authentication.
My question is, how the saving of the NTHash is preformed when a smartcard authentication takes place? Of course no plain text password in this case
Thanks, and if i stated wrong info please comment and correct me.