NTLM

security

Stands for: NT LAN Manager

A legacy Microsoft challenge-response authentication protocol.

NT LAN Manager authenticates a user via a challenge-response exchange without sending the password. Still seen in Windows environments, it is weaker than Kerberos and a frequent relay-attack target.

NTLM is the authentication protocol Windows used before Kerberos, and it survives because compatibility outlives design intent. It is a challenge-response scheme: the server sends a challenge, the client proves knowledge of the password hash without sending it, and no third party is consulted.

That last property is why it lingers. Kerberos needs a domain controller reachable at the moment of authentication; NTLM does not, so it remains the fallback when a machine connects by IP address rather than name, when the service principal name is missing or wrong, or when anything about the Kerberos path fails. Most surviving NTLM traffic in a modern domain is a Kerberos failure nobody diagnosed.

Its weaknesses are structural rather than incidental. The password hash functions as the credential, so stealing it is as good as knowing the password, which is pass-the-hash. Relay attacks forward an authentication attempt to a different service, and the protocol offers no channel binding by default to stop them. The direction of travel is disabling it entirely, and the practical obstacle is always an inventory problem: finding what still depends on it before turning it off.

Also known as: ntlm

← All glossary entries