Here is a really cool (but slightly modified) quote that I stumbled upon:
“If I cannot take the time to create and remember a nonsensical 12 digit password with numbers, symbols, and alternate cases, I might as well keep my “World Domination Plans” in an ASCII file on my desktop.”
Now that I have your interest peeked, let’s discuss an always interesting topic: What does secure Windows authentication mean? Considering this can be a very long and drawn out topic that might span several nights of blogs. Let’s looks at some of my more favorite considerations. To start, current versions of Windows generally have the ability of using LM, NTLM, NTLM V2, Kerberos, certificates, and Digest to authenticate to systems. The list may be formatted and termed a little differently if you are developer, but for an IT Pro these are the terms you should be most familiar with.
Of the supported methods, LM is by far the least secure and is only supported for down-level clients. Unless you have down-level clients, or really crappy applications, it may be in your best interest to disable LM authentication support in your environment. To accomplish this task you can either do one of three methods.
- Using GPO, security template, the security configuration wizard to enforce the following policies: Do not store LAN Manager hash value on next password change (Enable) and LAN Manager Authentication level (Send NTLMv2 response onlyrefuse LM)
- Hack the registry and enforce the same LAN Manager security policies that I just mentioned (which can just as easily be enforced using native Operating System tools also mentioned).
- Force all of your users to use passwords that are 15 characters or longer.
While forcing your users to use passwords of 15 characters or longer sounds cool. Implementing such a policy will just be headache for yourself and result in more work (unless you used pass phrases and smart users). Another reason for not taking this step is the fact that the “Do not store LAN Manager hash value on next password change” policy accomplishes the same thing by nullifying the LM hash value. The only important consideration with this policy is that it will need to be deployed by either linking at the root of a domain, site, or directly on your Domain Controllers OU. The link choice completely depends on where the accounts are located for which you are trying to enforce the policy.
Now that we now know how to disable LM our list supported authentication methods is: NTLM, NTLMv2, Kerberos, certificates, and Digest. In my next posting, I will be discussing the rest of the list how they relate to the concept of secure authentication.
