Number of PBKDF2 iterations for cached logon credential hashing

For domain logons, if credential caching is enabled, credentials are stored as MSCacheV2 hashes, derived using the PBKDF2-SHA1 hashing algorithm. The number of iterations for the PBKDF2-SHA1 algorithm used for hashing operations can be controlled with this policy, with the following logic: - For a value lower than or equal to 10240, the setting acts as a 1024-multiplier (for example, setting it to 20 will result in 20480 iterations). - For a value greater than 10240, the setting acts as the chosen value (modulo 1024). The recommended value depends on the target environment, the CPU power available, and the performance hit you are willing to tolerate at logon (a high value can incur a net performance penalty for the logon process). When the policy is enabled, the default value configured is 1954 (2,000,896 rounds). This is the recommended value (as of December 2022) for the PBKDF2-HMAC-SHA1 algorithm, considering the compute power of an RTX 4090 GPU in an offline brute-force attack model. More information: - https://tobtu.com/minimum-password-settings/ - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2