Enabling LAN Manager hash value store on next password change

Question

I am talking about this

Can I somehow set this setting to "Disabled" from registry or using any sort of command? I do know that it's unsafe, but when compatibility (with DOS) is at stake I don't care. The result of my research was Method 2 from this support article, however it speaks of opposite from what I want to achieve, and the way to "invert" the registry key addition is unobvious for me. If it was about setting the (freshly created) NoLMHash value to 1 for example, I would guess setting it to 0. But in this case I'm puzzled

P.S. Bonus question: do you think resetting the pass with net user login pass will trigger the hash storage?

Answer 1

Yes, if you set that value to zero in the Registry, LM hash storage will be enabled. In fact, changing that security setting via the UI modifies that Registry value on the back end. For the convenience of future readers, here's the key where you should set NoLMHash to 0 if you want this behavior:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Forcible password resets should have the same behavior as normal password changes with respect to hash storage, since the LSA has to update the Security Accounts Manager database either way.

Note that the Registry change may require a reboot before taking effect. Also, if a password is too long (>14 characters) to be LM-hashed, no LM hash will be stored for it no matter what your Registry says.