@stake LC 5

If you want a terrific password-auditing tool, I recommend the most recent version of L0phtCrack: @stake LC 5 (recently acquired by Symantec). New features let you remotely collect password hashes, schedule scans, score passwords, create audit reports, and speed up audits. LC 5 supports most password-cracking methods and comes in four versions (professional, administrator, site, and consultant—available features vary depending on version).

LC 5 optimizes operations by first scanning for dictionary words, then using various methods of altering dictionary words to create new probable guesses, then (if all else fails) resorting to brute force. To crack a password, the program must select a guessed word, compute the hash, then compare that hash with the stored password hash. LC 5 supports direct hash imports from a local or remote SAM database, a SAM file, an LC 4 file, a PWDUMP file, a Windows NT 4.0 Emergency Repair Disk (ERD), a UNIX password file, or by sniffing the local network. To speed the hashing process, most versions of LC 5 include precomputed hashes and let you create your own precomputed hash tables. During the audit, the tool shows time elapsed and other statistics.

LC 5 includes a remote agent that lets you centrally manage audits of multiple cross-domain computers and gather all account information at one location. After completing an audit, you can review risk scores, audit method, and character-set or password-length distribution. LC 5 also lets you disable accounts or force users to reset weak passwords.

—Jeff Fellinge