?
Solved

question on Microsoft password encryption/local policy

Posted on 2005-03-30
7
Medium Priority
?
126 Views
Last Modified: 2010-04-13
1. How does microsoft encrypt their passwords in the SAM? With a one way hash function?  Why is it so easy to crack the passwords once they are dumped??

2. What does the "store passwords with reversible encryption" setting in local policy do?
thanks
0
Comment
Question by:dissolved
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 35

Expert Comment

by:Nirmal Sharma
ID: 13670878
>>>1. How does microsoft encrypt their passwords in the SAM? With a one way hash function?  Why is it so easy to crack the passwords once they are dumped??

Why you want to know that?

>>>2. What does the "store passwords with reversible encryption" setting in local policy do?

This security setting determines whether the operating system stores passwords using reversible encryption.

This policy provides support for applications that use protocols that require knowledge of the user's password for authentication purposes. Storing passwords using reversible encryption is essentially the same as storing plaintext versions of the passwords. For this reason, this policy should never be enabled unless application requirements outweigh the need to protect password information.

This policy is required when using Challenge-Handshake Authentication Protocol (CHAP) authentication through remote access or Internet Authentication Services (IAS). It is also required when using Digest Authentication in Internet Information Services (IIS).

Ref: -  http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/eeff044c-d4a8-4699-a4b8-c5e563118c93.mspx

I think you are more familiar with this.

Let me know your requirement regard to this.
0
 

Author Comment

by:dissolved
ID: 13671479
>>>Why you want to know that?
Why not? ;-)
I'm doing password auditing. Just trying to figure out why an alphanumeric password was so easily cracked. I'm guessing the security tool is applying the same encryption algorithm to the stored passwords in the SAM?


>>This policy provides support for applications that use protocols that require knowledge of the user's password for authentication purposes.

You wouldnt happen to know if Dell's remote access cards use CHAP authentication would you?  They are PCI add in cards with ethernet and RJ11 connections.

Thanks
0
 
LVL 35

Accepted Solution

by:
Nirmal Sharma earned 2000 total points
ID: 13680082
I am out of office and will post on this saturdy.

Thanks
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 

Author Comment

by:dissolved
ID: 13689956
thanks man. Reply when ever your back in the office. Giving you full credit for this since you did answer the majority of my question.
Thanks again! Always a help
0
 

Author Comment

by:dissolved
ID: 13944643
well, you never responded man?
0
 
LVL 35

Expert Comment

by:Nirmal Sharma
ID: 13944866
I was really not in good state of mind for 20-30 days. You can see my record at EE. I didn't respond any question which i got through e-mail. From past three-four days i have started back to the thing. I really say sorry for my words.

Now please let me know if you want to proceed further on this.

Thanks for your support.
SystmProg
0
 

Author Comment

by:dissolved
ID: 13945369
understood bro. No love lost. Hope things look up for you . Keep ya head up
0

Featured Post

[Webinar] Lessons on Recovering from Petya

Skyport is working hard to help customers recover from recent attacks, like the Petya worm. This work has brought to light some important lessons. New malware attacks like this can take down your entire environment. Learn from others mistakes on how to prevent Petya like worms.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question