Why LM Hashes Are Blank in Windows Vista and Later

312-50v12 By islever Editorial Last updated

System Hacking

Short answer

C The Windows system is Vista or a later version, where LM hashes are disabled by default.

Question

An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?
  1. The SAM file has been encrypted using the SYSKEY function.
  2. The passwords exceeded 14 characters in length and therefore, the LM hashes were set to a “dummy" value.
  3. The Windows system is Vista or a later version, where LM hashes are disabled by default. Correct Answer
  4. The Windows system is using the Kerberos authentication protocol as the default method.

Key Takeaways

It tests knowledge of Windows password storage evolution, specifically the trap of assuming blank LM hashes indicate encryption rather than deliberate deprecation since Vista.

This question explains why NTLM hashes from the SAM file lack LM hash counterparts in modern Windows environments, confirming that default configurations disable legacy support.

Common mistake: Candidates often select SYSKEY encryption because it alters hash storage; however, SYSKEY does not clear LM hashes to empty strings but encrypts them with a system key.

Expert Analysis

Why the Answer Is Correct

Correct answer: C — In Windows Vista and later versions (including Server 2008), Microsoft disabled the storage of LAN Manager (LM) hashes by default. When an account is created or its password changed on these systems, the SAM file stores only the NTLM hash, leaving the LM hash field effectively blank or null.

Why the Other Options Are Wrong

Option A is incorrect because while SYSKEY encrypts the SAM database, it does not remove LM hashes; if LM were enabled, they would still be present but encrypted. Option B describes the behavior of older Windows versions (pre-Vista) where passwords longer than 14 characters resulted in a specific dummy LM hash value, not a blank one. Option D is irrelevant because Kerberos is an authentication protocol and does not dictate how passwords are stored in the local Security Account Manager (SAM).

Community Comment Notes

Community consensus strongly supports option C, with users noting that new Windows versions simply do not support LM by default. One user confirmed this aligns with official documentation stating that "new version dont support LM." Another comment provided a direct reference to Microsoft's technical overview, validating that LM hash storage is disabled by default starting with Vista.

Official Reference

https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview#passwords-stored-in-the-local-sam

This link opens the official vendor documentation in a new tab.

Exam Strategy

When analyzing SAM file dumps, always check the Windows version implied by the context; if it is Vista or newer, assume LM hashes are absent unless explicitly configured otherwise via Group Policy.

Frequently Asked Questions

Does SYSKEY encryption hide LM hashes?

No. SYSKEY encrypts the SAM database keys, but if LM hashing were enabled, the hashes would still exist in the file, just encrypted.

Can LM hashes be re-enabled on Windows 10?

Yes, via Group Policy under Network Security: LAN Manager authentication level, but it is strongly discouraged due to security risks.

More 312-50v12 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. insaniunt 👍 2 Answered C
    New versions of Windows still support LM hashes for backward compatibility; however, Vista and later Windows versions disable LM hashes by default. The LM hash is blank in the newer versions of Windows.
  2. qwerty100 👍 1 Answered C
    The storage of LM hashes is disabled by default since Windows Vista and Windows Server 2008 https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview#passwords-stored-in-the-local-sam
  3. duke_of_kamulu 👍 1
    C is the ANSWER How Hash Passwords Are Stored in Windows SAM is very clear in pg 587 that new version dont support LM correct answer C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide