Disabling Cashed accounts

Hi, new to the board...

My question is, I am trying to decide if I should disable cashed account passwords on my network. I've used CasheDump to pull the Local LM hashes from several machines and used Rainbow Crack to try and break these hashes to no avail (when i use LM taken from our AD using L0phtcrack it cracks the same passwords fine) ... but Ive also read that the local cashed passwords are salted a different way than regular LM hashes that are stored on the directory.
So what I am asking is, should i really be concerned with the local cashed passwords? I fell like I'm being a bit paranoid when I want to disable the cashe and also my network mgr looks at me like I'm going to cause a bigger problem if our AD goes down and he cant log into a certain machine... Just looking for some outside input..

Thanks,
7R0Y

Business Requirements + Legal Mandates = Technical Solutions.

Does your environment require this? Is there a threat that physical and or other access will be gained to this information?

Also, give 0phtcrack a try. It's the open source version of L0pht. My guess is that it will have a different result than rainbow.

Ok I will give it a try. Thank you for the info.

Hey C4573R 7R0Y and welcome to AO...mind explaining the dot before half the site tries to neg you?

Cheers

oh sorry, i had posted a reply and answered the question myself within 5 minutes. But i do have another question...


With ophcrack the rainbow tables it comes with are only alpha-numeric. I need those tables to include special chars... The rainbow tables that I created with rcrack have special chars... comes to a total with a chain length of 5400 and a rainbow chain count of 67108864 for each table with a total of 20 tables with that setting. Does anyone know if Ophcrack has precomputed tables with this type of setting... I am doubtful since it takes so long to make em.

I somehow doubt it.Most free precomputed hases on the net are generally 7 digit alpha-numeric.You might consider making your own if the situation warrants it though.Btw,did you try running your hashes through something like this? http://sarcaprj.wayreth.eu.org/
Also,if you think you messed up with Rcrack you may want to try WinRtgen..it's a window based freeware app:
http://www.oxid.it/projects.html

Cheers

Take a look on packetstorm. They tend to have exellent password dictionaries, rainbow tables and such.