I ran metasploit's
smart_hashdump module against my (2008r2) domain controllers, trying to find any accounts that may still have lanman hashes in place. These should have been disabled long ago. I'm just doing some cleanup before this years penetration testing and I wanted to find anything that had been missed.
I'm a bit confused by the output I'm seeing. All of my accounts have exact same hash in that column - aad3bb43....404ee.
I've seen a couple references to hashes beginning with aad3b43 being blank, but nothing about all these hashes being identical.
I take it that this value corresponds to some kind of internal 'disabled' state? I just want to be sure I'm understanding what I'm viewing.
The 7 null bytes describes exactly what I'm seeing.
We've long since had the lan man authentication level set to 5 and the don't use lm at next password change set so it isn't a matter of having no password set, or even a problem with a few users using short passwords.
I mostly wanted to be sure that the uniformity was intentional. I work with password hashes fairly regularly and almost never see duplicate entries. It just plain looked weird. I didn't think about the lm hash not using a salt and a fixed password always returning the same value. Makes perfect sense now. Thanks a ton.