What encryption used for password in Active Directory 2003 and How we can check and View

hi all,

i want know what encryption method used stored password in active directory 2003 , how can view settings.

as searched in different blogs, stored in 2 different formats--lm hash , nt hash. want check default

encryption method in  ad , how can view policy/settings in somewhere in ad server.

thanks in advance.

mukesh

---

mukesh bisht

hi

this how data stored in active directory database.

1. lm password hashed using ntowf, encrypted user's rid using systemfunction025, encrypted pek (password encryption key), stored in unicodepwd attribute

2. ntlm password hashed using ntowf, encrypted user's rid using systemfunction025, encrypted pek (password encryption key), stored in dbcspwd attribute.

note: pek (password encryption key) generated syskey of each dc, , key therefor unique on each dc/database. pek self maintained in none-readable, none-replicated attribute. (peeklist: http://msdn.microsoft.com/en-us/library/cc221063.aspx)

other password hash formats stored "keypackages" in supplementalcredentials attribute: http://msdn.microsoft.com/en-us/library/cc245674.aspx

the supplementalcredentials attribute protected local pek.

bonus: adam/adlds dose not drive it's pek syskey adds. adam/adlds dose not apply additional rid encryption using systemfunction025 unicodepwd , dbcspwd.

encryption types used in each step

1. pek - rc4 (the syskey)
2. unicodepwd/dbcspwd - rc4 (pek)
3. rid encryption - des (rid)

you have no ability change encryptions used above totally internal dblayer of active directory - thing can control not store new passwords in lm format (this default since windows server 2008)

dose answer question?

---

enfo zipper
christoffer andersson – principal advisor
http://blogs.chrisse.se - directory services blog

Windows Server  >  Directory Services