I need to find some materials about how Security Accounts Manager(SAM) works in windows 7+. I am confused with the storage format of hashed value.
Many materials (such as, 1) tells me that it uses NTLM(or NTLM v2). However, as far as I understand, the security level of NTLM is very low. Most OS(such as unix) will provide random salt to enhance basic security level. For NTML, we can break it easily with brute force in several days(even several hours with great device). Also, if we use rainbow table, we can achieve perfect result.
Some other materials (such as, 2) tells me that Windows Vista or above has replaced NTLM with Kerberos. Does it affect SAM? If so, in default, which hash algorithm does it use in Windows 7 or above?
To make my question clearly, I want to list them below.
Does NTLM or NTLMv2 use salt?
Which algorithm does windows 7 or windows 8 use for SAM?
Whether kerberos affects the hashed format of SAM?