Software

Ask something
Question Locked

Encryption technique in AD?

0 helpful
2 replies

by dewberry

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi there,

What encryption technique is used for the stored password hashes in Active Directory?

Is there in any way possible to support SHA2 for the hashes?

Best regards,
John

2 replies

by robo_dev

Trick Question?

Hashing is not encryption, so the passwords in Active Directory do not use an encryption method, because they are not encrypted.

Windows systems prior to Vista/2008 generate both a proprietary 'LAN Manager Hash' (LM Hash) and Windows hash (NT Hash) of passwords that are stored in the SAM.

http://en.wikipedia.org/wiki/LM_hash

Current Windows operating systems use the stronger NTLMv2 or Kerberos hashing methods, but the legacy LM/NT hash can be enabled for compatibility, if needed.

You cannot change to SHA2, as that would not be compatible with any Windows OS as a client.

From a security standpoint, SHA2 is better than LM/NT hash, but NTLMv2 is in the same ballpark.

This discussion is closed to new replies.