Glossary

Plain-language definitions of SEO terms used across the blog.

Boot key (syskey)

The 16-byte master key, hidden across four registry key class names in the SYSTEM hive, that seeds every Windows credential-encryption routine.

DCC2 (MS-Cache v2)

The salted, iterated verifier Windows caches so a domain user can log on offline. Crackable but not usable for pass-the-hash.

NT hash

The MD4 of a user's UTF-16LE password — the credential Windows actually stores and the one used in NTLM authentication and pass-the-hash.

NTDS.dit

The Active Directory database on a domain controller — an ESE/JET database holding every domain account and its encrypted credentials.