There is almost never any need to crack NT hashes. Note that cracking the NT hash rarely results in escalation of privileges due to the pass-the-hash vulnerability. E.g.: if you have and there is a leak of his email and password where the password matches your records, force a password change immediately.Īll of the above assumes that MFA is in place, your servers are patched, and there are extensive audit logs on all authentication attempts. The third thing is to match against specific leaks. I recommend at least the top 10,000 most common passwords being outright rejected. The second best thing to do is to scan password hashes against 'top password' lists and reject any that are in the top-N, where its up to your business policy what 'N' is. Use 20+ for privileged or service accounts. The single best security setting on a Windows network is to increase the minimum password length to something like 14 characters. A single GPU can crack all 8-character passwords in minutes.

All Windows passwords shorter than about 10 characters shouldn't be considered secure, as the NT Hash at this point is so easily reversible that it's basically a 'light obfuscation' at best.

Bitlocker password cracker