An organization wants to prevent lateral movement via Pass-the-Hash attacks on Windows. Which control most directly mitigates this attack at the endpoint level?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you stop Pass-the-Hash by making stolen hashes useless: Protected Users blocks credential caching and pushes Kerberos, while LAPS gives every machine a unique local admin password. Password complexity, antivirus, and web-app MFA don't stop hash reuse on the internal Windows network.
Full Explanation
The control that most directly mitigates Pass-the-Hash at the endpoint level is enabling the Protected Users security group for privileged accounts and implementing LAPS to randomize local admin passwords per machine. Protected Users prevents credential caching and forces Kerberos, eliminating NTLM hash reuse, while LAPS gives each machine a unique local admin password, so a stolen local admin hash cannot authenticate to other machines. Requiring complex passwords with special characters is wrong because pass-the-hash reuses the hash directly without cracking the password. Deploying endpoint antivirus with updated signatures is wrong because antivirus may detect Mimikatz tools used to extract hashes but cannot prevent hash reuse once captured. Requiring multi-factor authentication for all web applications is wrong because it does not protect NTLM authentication on the internal Windows network where Pass-the-Hash occurs.