Network security: Do not store LAN Manager hash value on next password change
The `NoLMHash` DWORD value set to `1` prevents Windows from generating and storing a LAN Manager password hash (LM hash) when an account password is next set or changed.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\System\CurrentControlSet\Control\Lsa\NoLMHash
The NoLMHash DWORD value set to 1 prevents Windows from generating and storing a LAN Manager password hash (LM hash) when an account password is next set or changed. For local accounts, this affects the local Security Accounts Manager (SAM) database. On domain controllers, it affects domain-account password data stored in Active Directory.
This setting does not prevent Windows from storing the NT hash. NTLM, NTLMv2, and Kerberos can continue to use the NT hash and do not inherently require an LM hash.
Notes
Security
LM hashes provide substantially less resistance to brute-force and password-cracking attacks than NT hashes. If an account database is compromised, preventing LM hash storage therefore makes it more difficult to recover the corresponding passwords and use them to impersonate users.
The setting does not protect the SAM database or Active Directory from being accessed. It removes the weaker password representation but does not address risks arising from compromised NT hashes or other credentials.
Possible side effects
Very old operating systems and applications that require an LM hash for authentication might no longer be able to authenticate. This primarily affects legacy Windows clients and can also affect some older third-party applications. Authentication methods that use the NT hash are not directly disabled by the absence of an LM hash.
Notes
The effect is not retroactive. An existing LM hash remains until the corresponding password is set or changed after the setting has taken effect.
Microsoft documents the associated security option for Windows 10 and Windows 11. The registry value is included in documented Windows Server security baselines through Windows Server 2022. In Windows Server 2025, the associated Group Policy setting is no longer present and, according to Microsoft, does not apply to the new Windows version.
Microsoft documentation
Microsoft Learn: Network security: Do not store LAN Manager hash value on next password change
Microsoft Learn: What's new in Windows Server 2025