Windows XP salted hashed verification of domain passwords

[Matthew Webster <awakenings () mindspring com>]

Folks,

    For domain accounts, the passwords are not kept on a system.  The verification is salted and hashed with md4 twice. 
 I am trying to assess the following risks.  1) What is the danger that that verification could be misused on another 
system?  2) From that salted, hashed verification, can the password be derived?  How likely is this?

     Also, how would one perform a pen test against those salted, hashed verifications?  Lets assume in the registry no 
one was ignorant enough to put the registry key which provides the password.

Thanks,

Matt



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------