Removing LM hashes from Windows 2003 Active Directory?

[humbletech99]

I have a Windows 2003 Active Directory domain and want a way of deleting all existing LM hashes from the AD database.

I know there is a gpo settings to stop Active Directory from creating LM hashes, but this doesn't deal with the ones that already exist.

Does anyone know if/how to remove all currently stored LM hashes from the domain?

[Monty007]

Here is another link http://support.microsoft.com/kb/299656
To remove current LM hashes users would have to change there password.

[humbletech99]

this only stops future hashes from being deleted, but there is a good workaround, remove pw history, then force pw changes with no lm hash enforced, which deletes all the old pws and then no lm hashes will survive... you can then re-enable pw history after that.

[Monty007]

So that all worked ok. Nice tip.

[humbletech99]

yeah, the only downside is that you lose all pw history and users can use all their old pws....