2 users that have the same passwords on windows 7. will the hashes in the SAM file be the same?

Question

Let's say I have a computer with win7 and I made 2 different accounts. Now I've set the same password for both accounts. My question is whether the hashes of the passwords in the SAM file will be same or not?

Thanks.

Answer 1

Short answer

Yes: users with the same password will share the same hash.

---

Long answer

Instead of storing your user account password in clear-text, Windows generates and stores user account passwords by using two different password representations, generally known as "hashes." When you set or change the password for a user account to a password that contains fewer than 15 characters, Windows generates both a LAN Manager hash (LM hash) and a Windows NT hash (NT hash) of the password. These hashes are stored in the local Security Accounts Manager (SAM) database or in Active Directory.

_{Source: How to prevent Windows from storing a LAN manager hash of your password in Active Directory and local SAM databases}

Neither the NT hash nor the LM hash is salted.

_{Source: Passwords Technical Overview}

Proof

1. Open a command prompt as administrator, and execute the following commands:

   net user "UserA" "Passw0rd!" /add
   net user "UserB" "Passw0rd!" /add
   

2. Dump the local LM/NT hashes using fgdump.

Here are the results in different operating systems:

• Windows 2000 / XP

  UserA:1001:B34CE522C3E4C87722C34254E51BFF62:FC525C9683E8FE067095BA2DDC971889:::
  UserB:1002:B34CE522C3E4C87722C34254E51BFF62:FC525C9683E8FE067095BA2DDC971889:::
  

• Windows Vista / 7

  UserA:1001:NO PASSWORD*********************:FC525C9683E8FE067095BA2DDC971889:::
  UserB:1002:NO PASSWORD*********************:FC525C9683E8FE067095BA2DDC971889:::
  

Briefly, the first field is the user account name; the second field is the unique Security Identifier for that account; the third field is the LM hash; the forth field is the NT hash.

The main difference is that starting with Windows Vista the the LM hash is no longer stored by default for security reasons. Apart from that, you can clearly see the hashes are identical.

Further reading

• Passwords Technical Overview
• Security Accounts Manager
• LM hash
• NT LAN Manager

Answer 2

Beginning with Windows Vista, Windows uses NTLMv2 to hash the passwords. Before this, the passwords would not be salted, making password hashes much less complicated and easy to get. Two users that have the same password should not have the SAM hash because of this salt.

Salt works by adding characters in some part of the password, making the password hash harder to brute force.