# The Straight Dope on cracking Windows cached domain credentials
**URL:** https://boards.straightdope.com/t/the-straight-dope-on-cracking-windows-cached-domain-credentials/542691
**Category:** Factual Questions
**Created:** [June 10, 2010, 7:21pm UTC](https://boards.straightdope.com/t/the-straight-dope-on-cracking-windows-cached-domain-credentials/542691 "2010-06-10T19:21:42Z")
**Posts on this page:** 2
**Page:** 2
### Author:  [@Bricker](https://boards.straightdope.com/u/Bricker)
#### Post date: [June 17, 2010, 12:42pm UTC](https://boards.straightdope.com/t/the-straight-dope-on-cracking-windows-cached-domain-credentials/542691/21 "2010-06-17T12:42:17Z")
> [@si\_blakely](#):
>
> My understanding is that it does, but only for across the wire challenge/response authentication. The hash stored in the SAM is still NTLMv1 (MD4). NTLMv2 is hardened against sniffing (really only LanMan authentication was sniffable), but if you can get the SAM, you have something you can attack.
>
> As with anything, physical access to the system in question gives you the ability to do pretty much what you want with it, unless you use full system encryption.
>
> Si
A bigger concern would be the cached local credentials. If I can assume an attacker might gain admin access to a local PC that’s a domain member but not to the server, then I’d be more worried about what he can learn from stored cached domain credentials.
(Of course, he could use the hash by itself, via hash injection, but besides that…)
---
### Author:  [@si\_blakely](https://boards.straightdope.com/u/si_blakely)
#### Post date: [June 17, 2010, 1:14pm UTC](https://boards.straightdope.com/t/the-straight-dope-on-cracking-windows-cached-domain-credentials/542691/22 "2010-06-17T13:14:26Z")
> [@Bricker](#):
>
> A bigger concern would be the cached local credentials. If I can assume an attacker might gain admin access to a local PC that’s a domain member but not to the server, then I’d be more worried about what he can learn from stored cached domain credentials.
I agree. Particularly for laptops that travel. I actually have a soft spot for well implemented hardware disk encryption (preferably two-factor), but software disk encryption can be good, too. It is just a shame that TrueCrypt does not do multi-user authentication. However, it would not be such a problem if Microsoft broke with NTLM and modified the stored hash format to include salt.
Si
[Previous page](https://boards.straightdope.com/t/the-straight-dope-on-cracking-windows-cached-domain-credentials/542691.md?page=1)