Windows NT, like Unix is considered a very high security system.<br>
<br>
The operating system uses the password as a parameter in an irreversible mathematical function that calculates a hash value. This hash value is then stored in the system password database (which, strangely enough, does no longer contain passwords but hash values). In order to validate a logon, the system uses the password supplied by the user, performs the mathematical function and then compares the hash value with the value stored in the password database. The premise is that when the hash values are equal, the two paswords used to generate the hash values are equal as well: the user is allowed access. Both UNIX and Windows/NT use this third method of storing password information.<br>
<br>
So if you look at a UNIX /etc/passwd file, the second field (the "password" field) does not contain passwords, but it contains the hash value that resulted from executing the UNIX hash function with the password as a parameter. Likewise, the Windows/NT security database (\WINNT\SYSTEM32\CONFIG\SAM) does not contain passwords but hash values generated from the Windows/NT hash function with the user's password as an input parameter.<br>
<br>
In operating system that store hash values instead of(encrypted) passwords it is impossible to decrypt user's passwords, even if you have full access to the system password database. However, systems storing hash values in publicly readable files are vulnerable to a so-called brute force attack. Because the hash functions are well documented, a hacker could try to generate all possible passwords, calculate their hash value and compare this hash value to the hash values stored in the system password database. Since the length of a password is bounded by a system limit, there is a finite number of possible passwords. It is theoretically possible to generate all possible passwords and hash them. Fortunately, the computing power needed in order to launch a full scale brute force attack is not generally available. In a system using eight character ASCII passwords there are approximately 7.2E16 possible passwords. Given a computer that can generate, hash and compare 1 million possible passwords per second it will take about 2258 years to search the entire password space. Since Windows/NT uses passwords of up to 14 characters a brute force attack with the same computer would take more then 600,000 billion years.<br>
<br>
What makes this really fun, is that users often use simple passwords only containing numbers, and/or letters. This makes passwords subject to dictionary attacks. Password cracking is most likely easier not because the system is unreliable, but because the user is not using the password protection to its full potential. When a user chooses a 3 letter password or even a 5 or 6 letter password instead of a maximum 128 character password, this greatly reduces the security of password protection. With Windows NT, using both an unreadable SAM in NT, as well as an NTFS files system unreadbale in DOS, or by other operating systems, without hacking intervention, it still makes it very hard to compromise the security of Windows NT. Now this does not mean that Windows NT is not crackable, but since any attempt to read the SAM in Win NT would require at least Administrator access, a SYSADMIN simply needs to make sure there is no direct access to the Windows NT machine, and that if there is, it is locke until a password is entered. Locking the Windows NT machine while not in use is always a good idea. Make sure the Windows NT Adminstrator password is not an easy password. Some examples of common passwords are, GOD, SEX, LOVE, DRUGS, your DOB, your SSN, your kid's name, your pet's name, your spouse's name, your name, etc. Passwords should be reasonable hard to remember, even for you. It should be a password that would take you a while to memorize. It should contain both numbers and letters and should be case sensitive. For these reasons the SAM does not really need to be moved. But for the sake of argument if you were to move the SAM, could a programmer just as easily take this program and add a search fuction, so if the SAM were moved it could easily be found?<br>
<br>
Just my opinion of course.<br>
<br>
