Detections
Analytics

2.3.11.5 Ensure 'Network security: Do not store LAN Manager hash value on next password change' is set to 'Enabled'

Information

This policy setting determines whether the LAN Manager (LM) hash value for the new password is stored when the password is changed. The LAN Manager (LM) hash is a legacy 16-byte hash of a user's password used in older authentication protocols. Tis hash is stored on the local system and is known for its weak security.

The recommended state for this setting is: Enabled.

The SAM file can be targeted by threat actors who seek access to username and password hashes. Such attacks use special tools to crack passwords, which can then be used to impersonate users and gain access to resources on your network. These types of attacks will not be prevented if you enable this policy setting, but it will be much more difficult for these types of attacks to succeed.

The LM hash is relatively weak and prone to attack compared to the cryptographically stronger Microsoft Windows NT hash. Since LM hashes are stored on the local computer in the security database, passwords can then be easily compromised if the database is attacked.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Do not store LAN Manager hash value on next password change

Impact:

None - this is the default behavior.

However, older operating systems and some third-party applications may fail when this policy setting is enabled. Also, note that the password will need to be changed on all accounts after this setting is enabled to gain the proper benefit.

See Also

https://workbench.cisecurity.org/benchmarks/26847

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|16.4

Plugin: Windows

Control ID: 6978c1af9254e642f57f4a2b07f41ae17a6eda127044e79ac8c8b25007b40d94