Can Active Directory use SALT?

Question

An outside audit of our on-premise environment has dinged us for not using SALT in our on-premise Active Directory environment in conjunction with the normal encryption/hash used by AD. I have not been able to find a suitable answer about this, most posts are from 10 or more years ago with regards to AD user password storage. We are currently running a functional level of 2012.

If AD can not use SALT, are there any good answers I can provide? I feel like it is not needed, we do not allow Domain Admins, etc.

Thanks

Answer 1

You want the Windows technical documentation.

Two important points:
Neither the NT hash nor the LM hash is salted
the NT hash is used in a Kerberos logon against the Key Distribution Center

That document is for up to Windows 7, but a Windows 8/Server 2012 document has - "There are no changes in functionality for NTLM for Windows Server 2012."

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994558(v=ws.10)?redirectedfrom=MSDN

Answer 2

Something here may help.
https://www.microsoft.com/security/blog/2019/05/30/demystifying-password-hash-sync/
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

Hi,
 
Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.
 
Best Regards,
Vicky

Answer 4

Thanks, at least I have something that we can provide that is official.