05-19-2017, 08:31 AM
I think that the hashes can still be cached and this process can somehow be compared to cached credentials within a local domain (LSA etc). I'm not an expert in this regard, but there must be some way to login to your work station even if the (local) network (domain controller etc) is down.
The credentials *could* still be cached (most probably also using the registry, just within other registry areas/keys)... the good news is that most password dump tools (including mimikatz, cachedump, creddump... etc, I'm not too sure which tool is the best one to use, maybe someone else could jump in here, but I think most of them should do the job just fine) know all these keys/locations of cached/stored passwords and therefore the user does not need to know where the hashes come from.
The credentials *could* still be cached (most probably also using the registry, just within other registry areas/keys)... the good news is that most password dump tools (including mimikatz, cachedump, creddump... etc, I'm not too sure which tool is the best one to use, maybe someone else could jump in here, but I think most of them should do the job just fine) know all these keys/locations of cached/stored passwords and therefore the user does not need to know where the hashes come from.