Windows Password Hashes & Authentication

Windows authentication can involve several types of credential material depending on whether the account is local, domain-based or authenticated across the network. The most important concepts to distinguish are passwords, NT hashes, NTLM challenge-response values and cached domain credentials.

A password is the original secret chosen by the user. A hash is a one-way value derived from that password. A challenge-response value is generated dynamically during authentication and is not the same thing as the stored password hash.

LM is a legacy Windows password hashing mechanism. It is considered weak because it converts passwords to uppercase, splits them into independent blocks and provides very limited resistance against cracking. Modern Windows systems normally have LM hashing disabled.

Modern Windows password authentication is based primarily on the NT hash. The NT hash is generated from the user password and is normally represented as 32 hexadecimal characters. It is often informally called an NTLM hash, although NTLM is technically the authentication protocol rather than the hash itself.

NTLM is a Windows challenge-response authentication protocol. The password itself is not normally transmitted across the network. Instead, the server sends a challenge and the client calculates a response using credential material derived from the user password.

The client requests authentication, the server returns a challenge, the client generates a response and the server verifies that response locally or through a Domain Controller. The important point is that the network exchange contains a challenge-response value rather than the plaintext password.

An NT hash and a NetNTLM response are not interchangeable. The NT hash is derived directly from the password and represents reusable credential material in some Windows authentication scenarios. NetNTLMv1 and NetNTLMv2 are challenge-response values generated during network authentication.

NetNTLMv1 is the older and weaker challenge-response mechanism. NetNTLMv2 provides stronger protection and is the version normally encountered on modern Windows systems. A captured NetNTLMv2 value may be tested offline against candidate passwords, but it cannot simply be treated as an NT hash.

Local accounts belong to a specific Windows machine and are authenticated using credential information stored locally. They can be referenced using the computer name or a dot prefix.

Domain accounts are managed centrally through Active Directory. Their authentication information is stored on Domain Controllers and the same account can normally be used across multiple domain-joined systems depending on its permissions.

The Security Account Manager stores authentication information for local Windows accounts. The SAM database is protected by the operating system and is not normally readable directly while Windows is running.

The SYSTEM registry hive contains key material used by Windows to protect secrets stored in the SAM database. For this reason, SAM and SYSTEM are commonly referenced together when studying local Windows credential extraction.

On a Domain Controller, Active Directory credential information is stored in the NTDS database rather than the local SAM. NTDS.dit contains directory objects and password-related data for domain accounts.

SAM is associated with local Windows accounts on an individual system. NTDS.dit is associated with Active Directory and domain accounts on a Domain Controller. This distinction is fundamental when analysing Windows credentials.

LSASS is the Windows process responsible for enforcing local security policy and handling authentication. Depending on the authentication method and session state, credential-related material may be present in LSASS memory.

Windows can cache domain logon information so that users can still sign in when a Domain Controller is unavailable. Modern systems commonly use Domain Cached Credentials version 2, also known as DCC2 or MSCache v2. These values are different from NT hashes.

Correctly identifying the credential format is important before analysing or testing it. NT hashes, NetNTLMv2 responses and cached domain credentials all use different formats and require different handling.

When a password-derived value is available during an authorised assessment, it can be tested offline against candidate passwords. Offline testing does not repeatedly contact the target authentication service, so it behaves differently from online login attempts.

Reusing the same password across several systems increases the impact of a compromised account. This becomes particularly dangerous when the same local administrator password is used on multiple Windows hosts.

In some Windows authentication scenarios, recovering the plaintext password is not required because the NT hash itself can be used as authentication material. This behaviour is the basis of Pass-the-Hash, which is covered separately as a credential reuse and lateral movement technique.

LM is a legacy password hash. NT is the modern Windows password hash. NTLM is the authentication protocol. NetNTLM is a network challenge-response value. SAM stores local account information. NTDS.dit stores Active Directory information. LSASS handles authentication in memory. DCC2 represents cached domain logon information.