Best way to provent someone stealing password Hashes..?

Hey everyone,

I am doing some research on finding the best way to prevent someone with access to our network getting Active Directory password Hashes. Specifically, are there any legacy group policy's that should be looked at to tighten security?

Let me know if I need to add additional info.

Thanks!
Shawn