Although, in some cases just having the hash is enough: https://en.wikipedia.org/wiki/Pass_the_hash https://en.wikipedia.org/wiki/Pass_the_hash User PC gets ow

Although, in some cases just having the hash is enough: https://en.wikipedia.org/wiki/Pass_the_hash https://en.wikipedia.org/wiki/Pass_the_hash User PC gets owned, attacker elevates to admin, now has access to IT Support hashes cached locally which can be sent to other devices directly to authenticate.