Re: LM hashes in a hot-desking environment

[The Little Prince <thelittleprince () asteroid-b612 org>]

On Sat, 27 May 2006, Ansgar -59cobalt- Wiechers wrote:

> On 2006-05-25 feedb4ck () z4ck org wrote:
> > Although it is a well known fact that Windows desktops and servers
> > still use LM Hashes and cache the last ten userids and passwords
> > locally, just in-case an Active Directory, Domain, or NDS tree are not
> > available, has anyone thought about the consequences of this issue in
> > a hot-desking, or flexible working environment?
>
> That's why you use policies to disable use of LM hashes and caching of
> passwords in environments like that.

Exactly. You don't do caching on computers that won't ever come off the 
network. i.e. don't do it on desktops. If you have that much of a problem 
with AD being unavailable, you better look more closely at your AD 
architecture.
You may do caching on laptops, and then i'd hope you don't have people 
sharing laptops. If you do, well then, that's another story requiring 
careful consideration, but a little off-topic.

--Tony
.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-
Anthony J. Biacco                            Systems/Network Administrator
thelittleprince () asteroid-b612 org             http://www.asteroid-b612.org

        "as I always say, why go Merlot, when you can call a Cab?"
.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-