06-06-2017, 10:30 AM
Some useful info that I have come across on this.
Authentication credentials are stored differently in the SAM/SYSTEM files when using a 'normal' offline windows account compared to an 'online' Microsoft account. Samdump2 for example will incorrectly give you the NTLM for an empty string if a Microsoft account is being used but Mimikatz will correctly give you the right NTLM.
When a user logs into their machine using their Microsoft account, their details will be cached onto the machine which allows them to log on even if they are offline. If a user changes their Microsoft account password online on a different machine/device, even if the original machine is connected to the internet, they can proceed to log in using the old password. It is only when they log in with the new password, does the cached details get updated.
Authentication credentials are stored differently in the SAM/SYSTEM files when using a 'normal' offline windows account compared to an 'online' Microsoft account. Samdump2 for example will incorrectly give you the NTLM for an empty string if a Microsoft account is being used but Mimikatz will correctly give you the right NTLM.
When a user logs into their machine using their Microsoft account, their details will be cached onto the machine which allows them to log on even if they are offline. If a user changes their Microsoft account password online on a different machine/device, even if the original machine is connected to the internet, they can proceed to log in using the old password. It is only when they log in with the new password, does the cached details get updated.