Glossary
Plain-language definitions of the terms used across this site.
- DCC1 (MS-Cache v1)
- The original cached domain-logon verifier (mscash), used before Windows Vista. Weaker than DCC2 but, like it, crack-only and not usable for pass-the-hash.
- DPAPI
- The Windows Data Protection API. Its machine-scope keys live in the SECURITY hive (DPAPI_SYSTEM) and can be recovered offline to decrypt system-protected secrets.
- LSA secrets
- Secrets the Windows LSA keeps in the SECURITY hive — service passwords, the machine account, DPAPI keys and the cached-logon key — all decryptable offline with the boot key.
- Pass-the-hash (PtH)
- Authenticating to a Windows service with a user's NT hash instead of their password, exploiting the fact that NTLM uses the raw hash as the secret.
- PEK (Password Encryption Key)
- The key that encrypts every password hash inside NTDS.dit. The PEK list is itself wrapped with the domain controller's boot key.
- SysKey
- The Windows feature that encrypts the SAM database on disk, and the 128-bit key behind it — the boot key scattered across four SYSTEM registry subkeys.
- Boot key (syskey)
- The 16-byte master key, hidden across four registry key class names in the SYSTEM hive, that seeds every Windows credential-encryption routine.
- DCC2 (MS-Cache v2)
- The salted, iterated verifier Windows caches so a domain user can log on offline. Crackable but not usable for pass-the-hash.
- NT hash
- The MD4 of a user's UTF-16LE password — the credential Windows actually stores and the one used in NTLM authentication and pass-the-hash.
- NTDS.dit
- The Active Directory database on a domain controller — an ESE/JET database holding every domain account and its encrypted credentials.