Smart Cards in Active Directory

🔒Secure Bits💡
Do you use 𝗦𝗺𝗮𝗿𝘁 𝗖𝗮𝗿𝗱𝘀 𝗶𝗻 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 ?

Great—but did you know NT Hashes are still cached by default? That’s all an attacker needs. Without proper configuration, an NT Hash can remain unchanged indefinitely!

✅ 1. Smart Card Authentication (Image 1) – Replaces the user’s password with a random NT hash, but this hash remains static unless rotated.

✅ 2. NT Hash Rotation (Image 2) – Enables automatic NT hash changes based on password policy, preventing long-term hash reuse.

✅ 3. Protected Users Group (Image 3) – Prevents NT hash caching in memory (LSASS) and forces Kerberos-only authentication (and much more).

💡 Are you using Smart Cards? Have you secured NT Hash caching properly?