Pass-the-Hash (PtH) attacks against the Windows operating systems are becoming common. Microsoft wants organizations to assume that a breach has already occurred in order to highlight the need for a more mature defense. In most organizations, the Local Administrator Password is shared amongst many administrators and is a small set of static strings. This raises major security concerns specially when it comes to Pass-the-Hash attacks.
With AD Client Extensions installed, Local Administrator Password is system generated and stored in Active Directory in encrypted form. Passwords are validated regularly and reset to maintain the integrity. The password vault is infallible to the extend of AD Domain Infrastructure. Only designated administrators are allowed to retrieve and decrypt the password strings.