Editing LAN Manager (section)

==Workarounds==
To address the security weaknesses inherent in LM encryption and authentication schemes, Microsoft introduced the [[NTLMv1]] protocol in 1993 with [[Windows NT 3.1]]. For hashing, NTLM uses [[Unicode]] support, replacing <code>LMhash=DESeach(DOSCHARSET(UPPERCASE(password)), "KGS!@#$%")</code> by <code>NThash=[[MD4]]([[UTF-16]]-LE(password))</code>, which does not require any padding or truncating that would simplify the key.  On the negative side, the same DES algorithm was used with only [[56-bit encryption]] for the subsequent authentication steps, and there is still no salting.  Furthermore, Windows machines were for many years configured by default to send and accept responses derived from both the LM hash and the NTLM hash, so the use of the NTLM hash provided no additional security while the weaker hash was still present.  It also took time for artificial restrictions on password length in management tools such as User Manager to be lifted.

While LAN Manager is considered obsolete and current Windows operating systems use the stronger NTLMv2 or [[Kerberos (protocol)|Kerberos]] authentication methods, Windows systems before [[Windows Vista]]/[[Windows Server 2008]] enabled the LAN Manager hash by default for [[backward compatibility]] with legacy LAN Manager and [[Windows ME]] or earlier clients, or legacy [[NetBIOS]]-enabled applications. It has for many years been considered good security practice to disable the compromised LM and NTLMv1 authentication protocols where they aren't needed.<ref name="KB299656">{{cite web
| url=https://learn.microsoft.com/en-US/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
| title=How to prevent Windows from storing a LAN manager hash of your password in Active Directory and local SAM databases
| work=[[Microsoft Docs]]
| date=December 3, 2007
| access-date=October 16, 2023}}</ref>
Starting with Windows Vista and Windows Server 2008, Microsoft disabled the LM hash by default; the feature can be enabled for local accounts via a security policy setting, and for [[Active Directory]] accounts by applying the same setting via domain [[Group Policy]]. The same method can be used to turn the feature off in Windows 2000, Windows XP and NT.<ref name="KB299656"/> Users can also prevent a LM hash from being generated for their own password by using a password at least fifteen characters in length.<ref name="KB828861"/>—NTLM hashes have in turn become vulnerable in recent years to various attacks that effectively make them as weak today as LanMan hashes were back in 1998.{{Citation needed|date=August 2016}}