RE: Password audits

To get around the risk of crashing LSASS, I'd perform a Windows backup of
the Windows directory and look for the backup SAM file in the Windows/Repair
folder.

As seems to be expected on mailing lists, here's a link:

http://www.infowar.com/forums/showthread.php?threadid=6886

Enjoy.


Isaac Van Name
Systems Administrator
Southerland, Inc.
ivanname@xxxxxxxxxxxxxxxxxxxx

"What good would you do with an ignorant employee? Ignorance is grounds for
dismissal..." - Mario Spinthiras

Open Source developing at its finest:
"Written in vim, W3C valid and UTF-8 encoded, for her pleasure."

Disclaimer: This email is intended only to be used to feign intellectual
mastery of a subject or superhuman command of the English language, when
profanity is involved. By reading this email, you are agreeing to cease all
correspondence with the sender upon realizing your own ignorance, and
furthermore to refrain from taking legal action against said sender when
your compounding ignorance crushes your inadequate self-esteem. Have a nice
day.

Original> -----Original Message-----
Original> From: listbounce@xxxxxxxxxxxxxxxxx
[mailto:listbounce@xxxxxxxxxxxxxxxxx]
Original> On Behalf Of xelerated
Original> Sent: Monday, October 23, 2006 7:01 AM
Original> To: pen-test@xxxxxxxxxxxxxxxxx
Original> Subject: Password audits
Original>
Original> I have been given the task of doing a password audit.
Original> No problem, except I can use pwdump for the slight risk of
Original> having to reboot a DC.
Original>
Original> I know there are many ways to get a pw dump from a DC but my
question
Original> is this.
Original> What is the safest way to get that, so that you dont risk having a
DC
Original> need to reboot
Original> or have to install software on the DC?
Original>
Original> In the past I have used pwdump, different versions, and usually i
Original> didnt have to reboot the box, but there was that rare occasion
that
Original> that it made lsass puke and had to be rebooted.
Original>
Original> Thanks in advance for your input.
Original>
Original> Chris
Original>
Original>
------------------------------------------------------------------------
Original> This List Sponsored by: Cenzic
Original>
Original> Need to secure your web apps?
Original> Cenzic Hailstorm finds vulnerabilities fast.
Original> Click the link to buy it, try it or download Hailstorm for FREE.
Original>
http://www.cenzic.com/products_services/download_hailstorm.php?camp
Original> =701600000008bOW
Original>
------------------------------------------------------------------------
Original>



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: SP2 - Why bother?
    ... where are the major security updates for this OS?" ... A SunSparc with Windows ... >> Since you "don't quite understand the theory of installing SP2", ... > Choices that I make, have associated risk, the risk of programs not ...
    (microsoft.public.windowsxp.general)
  • Controlling Annoying Reboots
    ... Interesting article from the Windows Secrets newsletter. ... But if you're right in the middle of something, seeing Windows reboot ... control how often Windows reminds you to reboot after installing patches - ... That was a production server running our organization's main SQL database! ...
    (microsoft.public.windowsxp.general)
  • Re: Explorer doesnt start anymore
    ... How to start Windows in Safe Mode Windows XP ... To isolate problems using Selective Startup options ... You can try disabling half of the startup entries, reboot and see if you ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: How workable is Vista?
    ... I read somewhere that it's now possible to disable the gui altogether on server versions of windows - almost like on a real server operating system. ... There is no practical need to do updates to the original versions. ... Usage varies widely according to geographic area and the sort of web site used for surveys, but the market is split roughly evenly between IE6, IE7, and Firefox. ... In the most of cases you can continue safely without reboot even if they required it. ...
    (comp.arch.embedded)
  • Re: Mysterious Rundll32.exe, Administrator privileges
    ... rebooting will generate new random .dll files ... is created for when you reboot again. ... Pops up spyware windows occasionally from the RunDll32.exe process ... Run Hijack This and delete any suspected entries ...
    (microsoft.public.windowsxp.security_admin)