Why LM Hashes Are Blank in Windows Vista and Later
An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
It tests knowledge of Windows password storage evolution, specifically the trap of assuming blank LM hashes indicate encryption rather than deliberate deprecation since Vista.
This question explains why NTLM hashes from the SAM file lack LM hash counterparts in modern Windows environments, confirming that default configurations disable legacy support.
Candidates often select SYSKEY encryption because it alters hash storage; however, SYSKEY does not clear LM hashes to empty strings but encrypts them with a system key.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: C — In Windows Vista and later versions (including Server 2008), Microsoft disabled the storage of LAN Manager (LM) hashes by default. When an account is created or its password changed on these systems, the SAM file stores only the NTLM hash, leaving the LM hash field effectively blank or null.Why the Other Options Are Wrong
Option A is incorrect because while SYSKEY encrypts the SAM database, it does not remove LM hashes; if LM were enabled, they would still be present but encrypted. Option B describes the behavior of older Windows versions (pre-Vista) where passwords longer than 14 characters resulted in a specific dummy LM hash value, not a blank one. Option D is irrelevant because Kerberos is an authentication protocol and does not dictate how passwords are stored in the local Security Account Manager (SAM).Community Comment Notes
Community consensus strongly supports option C, with users noting that new Windows versions simply do not support LM by default. One user confirmed this aligns with official documentation stating that "new version dont support LM." Another comment provided a direct reference to Microsoft's technical overview, validating that LM hash storage is disabled by default starting with Vista.Official Reference
Exam Strategy
When analyzing SAM file dumps, always check the Windows version implied by the context; if it is Vista or newer, assume LM hashes are absent unless explicitly configured otherwise via Group Policy.
Frequently Asked Questions
Does SYSKEY encryption hide LM hashes?
No. SYSKEY encrypts the SAM database keys, but if LM hashing were enabled, the hashes would still exist in the file, just encrypted.
Can LM hashes be re-enabled on Windows 10?
Yes, via Group Policy under Network Security: LAN Manager authentication level, but it is strongly discouraged due to security risks.