Pass-the-Hash (PtH) attacks against the Windows operating systems are becoming common. Microsoft wants organizations to assume that a breach has already occurred in order to highlight the need for a more mature defense. This article helps organizations plan their strategies for a more effective defense against pass-the-hash attacks.

With AD Client Extensions software installed, the Local Administrator Password is system generated and unlike Windows LAPS, it is stored in Active Directory in encrypted form. No AD Schema Changes are required, and password can be stored in custom application partition thus allowing control over the replication to specific and physically well secured DCs. Passwords are validated regularly and reset to maintain their integrity. Only designated administrators are allowed to decrypt the password strings.

The feature was first launched in ADCE 2012 and has matured significantly over the past years making it a proven solution for large enterprise customers.