There' a pretty good Microsoft KB article on this exact subject.
Basically, LM is used for compatibility with older clients. Specifically, Windows 98 and below. If you do not have any older clients on the network, then the cause for both hashes is most likely due to the password length being <15 characters.
When you set or change the password for a user account to a password
that contains fewer than 15 characters, Windows generates both a LAN
Manager hash (LM hash) and a Windows NT hash (NT hash) of the
It appears that the reason for this is due to the hashing limitations of LM, and not security related.
In the event that the user's password is longer than 15 characters,
the host or domain controller will not store the LM hash for the user;
the LM response cannot be used to authenticate the user in this case.
A response is still generated and placed in the LM Response field,
using a 16-byte null value (0x00000000000000000000000000000000) as the
LM hash in the calculation. This value is ignored by the target.
It is advised to disable LM hashes as the protocol is severely broken as you suggested. For those who might not be aware, some of the problems with LM's include:
- Passwords are not case sensitive.
- Password are split into 7 chars and hashed seperately, making brute force trivial.
- Passwords are limited to a maximum of 14 characters in length.
There are a couple methods to removing LM hashes listed on the KB article I mentioned, I will quote the GPO method in case the link goes bad.
Method 1: Implement the NoLMHash Policy by Using Group Policy
To disable the storage of LM hashes of a user's passwords in the local computer's SAM database by using Local Group Policy (Windows XP or Windows Server 2003) or in a Windows Server 2003 Active Directory environment by using Group Policy in Active Directory (Windows Server 2003), follow these steps:
- In Group Policy, expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click Security Options.
- In the list of available policies, double-click Network security: Do not store LAN Manager hash value on next password change.
- Click Enabled, and then click OK.