Microsoft® Windows® 2000 Security Handbook

The Risks of Using NTLM

The first and foremost risk with a Windows 2000 or NT system is control over the SAM database. As you undoubtedly know, all user accounts and passwords are stored in the SAM database on NT systems. With Windows 2000, workstation and local logins are managed using information retained in the SAM database, and of course, the SAM is used exclusively if Active Directory is not in use.

Stealing the SAM database would be the easiest route to take. By default, Windows NT stores a copy of the SAM in the folder called %root%\repair. Access to this critical folder allows anybody to read, and hence to steal, the contents. Restricting access to administrators only is the first improvement to make.

With a copy of the SAM database, ...