WDigest, LM hashes and NTLMv1: removing the legacy settings that expose credentials

WDigest: the clear-text password in memory

WDigest is an old authentication protocol, used in particular for HTTP Digest authentication. To work, it kept the user's password in a reversible form in the memory of the LSASS process. An attacker with administrative rights on the machine could then recover the clear-text password of every logged-on user, including administrators who happened to connect.

Since Windows 8.1 and Windows Server 2012 R2, this storage is disabled by default, and an update brought the same option to older versions. It is controlled by the UseLogonCredential registry value under the WDigest provider key. If it is set to 1, the legacy behaviour returns. An attacker who has taken over a machine can also set it and wait for the next logon, so changes to it must be monitored.

The fix: force the value to 0 through Group Policy (the Microsoft security guide administrative templates include a dedicated setting) and alert on any change.

LM hashes

The LAN Manager hash is a very old format: it splits the password into two seven-character blocks, converted to uppercase, which makes it extremely weak against offline attacks. Since Windows Vista and Windows Server 2008, the setting "Network security: Do not store LAN Manager hash value on next password change" has been enabled by default.

Two things remain to check. First, that an old GPO has not disabled this setting. Second, that accounts whose password has not changed in a long time do not still carry an LM hash computed back then: the setting only applies at the next password change. Old accounts, service accounts in particular, therefore need a password change.

NTLMv1 and the LAN Manager authentication level

NTLMv1 relies on obsolete cryptography: a response captured on the network can be reduced fairly easily to the account's NT hash, which can then be used to authenticate elsewhere. When a domain controller accepts NTLMv1, an attacker who obtains an NTLMv1 authentication from a DC computer account can go a very long way.

The key setting is "Network security: LAN Manager authentication level". The target value is "Send NTLMv2 response only. Refuse LM and NTLM", applied to domain controllers and members alike. Microsoft has announced the removal of NTLMv1 in recent Windows versions; check the exact status for the versions in your estate in current Microsoft documentation.

Measure before you block

Refusing NTLMv1 can break older equipment: copiers, appliances, line-of-business applications. Before switching, identify the clients involved. Logon events (4624) on domain controllers show which NTLM version was used, and the "Restrict NTLM" settings in audit mode help inventory NTLM usage more broadly. Handle exceptions by updating or replacing the equipment rather than keeping a low authentication level for the whole domain.

What an audit checks

• the value of UseLogonCredential on servers and workstations, and the GPOs that set it;
• the LM hash storage setting and how old account passwords are;
• the LAN Manager authentication level applied to domain controllers;
• NTLMv1 authentications in domain controller logs;
• deployment of Credential Guard and LSA protection.