LM Hash Storage (No
Whether Windows still stores the weak LM hash of local passwords.
Use it to tell whether Windows is set to store the weak LM hash when local passwords next change.
- SYSTEM
- Defence Evasion
What It Is
Windows keeps each password as a hash, a scrambled form of it, in the local Security Accounts Manager (SAM) database or in Active Directory. For a password shorter than 15 characters it can keep both the NT hash and the older LAN Manager (LM) hash. The LM hash is much weaker and quick to crack by brute force, so Windows 10 and 11 are set by default not to store it. NoLMHash, in the Lsa key of the SYSTEM hive, holds that choice, and it takes effect at each password's next change.
What It Proves
NoLMHash set to 1 stops Windows storing the LM hash at the next password change. A 0 or missing value on a modern build means the weak hash may be kept, lowering the effort to crack local passwords.
What It Does Not Prove
It affects the next password change, not existing hashes. Windows Vista and later default to not storing LM, so a 0 is a deliberate downgrade rather than the norm.
Where It Lives
LM Hash Storage (NoLMHash) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| NoLMHash is in the secure state, so no LM hash is stored. A later change to 0 weakens every local password at its next change. |
| LM storage is allowed again, a downgrade on modern Windows. Set it back to 1 and rotate local passwords. |
| The host still uses the weaker NTLMv1 on the network, not NTLMv2. Read it with NoLMHash and raise it to 5 where you can. |
How to Read It
Read NoLMHash under Control\Lsa, where 1 is the secure state. Read LmCompatibilityLevel in the same key for how the host negotiates LM and NTLM on the network. To put it right, set NoLMHash to 1 and force a password change so stored hashes are refreshed.
- When Windows Writes It
- It is written when Group Policy or an administrator sets the value. The stored hash changes at the next password change.
- Which Windows Versions
- Windows XP SP3 to 11 (Vista and later default to no LM hash)
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (lsa)
Hunt It
Defender records other values in the Lsa key, but confirm these writes appear before relying on it. NoLMHash at 0 affects passwords from their next change, not the hashes already stored.
// LM hash storage or LM level changed or removedDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what LM Hash Storage (NoLMHash) shows.
- Local AccountsGives each local account's last password change, which decides whether an LM hash was stored.
- NTLM Logons, Security Event 4624Not in the RegistryShows which logons used LM or NTLM, from the package each event names.
Sources
The facts on this page come from these public pages, which say more on each point.