The Ntlmv2 Technique

By Author: smileyi
Total Articles: 31
Comment this article

When replacing legacy machines is not possible, and to ensure that when Kerberos is not used, the strongest authentication protocol you should specify MCSE

In a pure Windows network, or in sections of the network where communication is restricted to Windows machines, you should strengthen authentication by selecting stronger authentication protocols. Stronger authentication protocols can be selected by replacing legacy machines with Windows computers that can use the Kerberos protocol. When replacing legacy machines is not possible, and to ensure that when Kerberos is not used, the strongest authentication protocol you should specify is NTLM and possibly NTLMv2. You should also eliminate the LM hash from the account database. IT Exams

Exam Tip The security option called Network Security: Do Not Store LAN Manager Hash Value on Next Password Change can be used to prevent the storage of the LM hash. Windows 2000 service pack 2 and later and Windows XP computers can accomplish the same task via a registry edit. However, the process ...
... is not completed until the next time the user changes his password. MCSE Exam

To select NTLM or NTLMv2:
For Windows 2000 and Windows Server 2003 computers, use the Security Option,

Network Security: LAN Manager authentication level.

For Windows NT service pack 4 computers, a registry modification must be made.

Windows 95/98 computers with the Active Directory client installed can also use

NTLM or NTLMv2 if a registry entry is made.

Tip Knowledge Base article 239869 details how to make NTLM and NTLMv2 changes for improved network authentication and session security. MCSE Certification