RE: L0phtCrack and Windows 2000 LM Hashes

You could simply just look.

HKLM\System\CurrentControlSet\Control\Lsa\NoLMHash  The "NoLMHash" is a key
not a value.

Dave
 

>> -----Original Message-----
>> From: Brad Judy [mailto:[email protected]]
>> Sent: Friday, February 07, 2003 11:42
>> To: 'dave'; 'Chris Mawer'; [email protected];
>> [email protected]
>> Subject: RE: L0phtCrack and Windows 2000 LM Hashes
>> 
>> > >> My win2k box shows that three user-accounts on my windows 2000
>> > >> machine report as being *empty*, <8 and 2 of the three
>> > share a NULL
>> > >> password LM Hash of AAD3B435B51404EEAAD3B435B51404EE. The
>> > third hash
>> > >> is different and I do not wish to report it here for what id deem
>> > >> obvious reasons.
>> >
>> > This hash means there is no LM hash store which is good. This
>> > means the NOLMhash key exists.
>> >
>> > The one that does show a different one just change the
>> > password, it only takes effect once the password is changed.
>> > It then should show AAD3B435B51404EEAAD3B435B51404EE like the others.
>> >
>> > Dave
>> 
>> Or it simply means that LM is not disabled, but these two accounts have
>> 15+ character passwords.
>> 
>> Brad Judy
>>