DataTerminology.comNEW
Also known as: NT LAN Manager
Microsoft challenge–response authentication protocol for network logon and session security, used when Kerberos is unavailable.
DESCRIPTION
NTLM provides authentication, integrity, and confidentiality via a challenge–response mechanism without sending passwords over the wire. NTLMv2 improved security, but NTLM remains susceptible to relay and pass-the-hash attacks if misconfigured. It is commonly used for legacy systems, workgroup environments, and scenarios without Active Directory or Kerberos. Modern guidance recommends Kerberos where possible and restricting NTLM. Administrators can control NTLM via policy and auditing, and harden SMB and HTTP endpoints to reduce risk.
ALTERNATIVE DEFINITIONS
Microsoft Learn
NTLM is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users.
Frames NTLM as a protocol suite with multiple security properties.
OWASP
NTLM is an authentication protocol that uses a challenge-response mechanism and is vulnerable to relay attacks when message signing is not enforced.
Highlights vulnerability context and required mitigations.
RELATED TERMS
Active Directory SSPI LM Hash NTLMv2 Pass-the-Hash Challenge-Response SMB Single Sign-On LDAP
COMPETING TERMS
KNOWLEDGE AREAS
Data Security Infrastructure Software Engineering
TARGET AUDIENCE
Security Architect Cybersecurity Engineer IT Manager Application Administrator DevOps Engineer Software Developer
EXTERNAL SOURCES
- Wikipedia - NTLM
- Microsoft - Official NTLM protocol overview
- OWASP - Security risks and mitigations
- MITRE ATT&CK - Technique: NTLM relay attacks
TOP QUESTIONS
When is NTLM used instead of Kerberos?
NTLM is used in workgroup environments, cross-forest scenarios without trusts, or when a service cannot use Kerberos.
Category: Requirements
What are NTLM’s main risks?
Relay and pass-the-hash attacks are common; weak signing and outdated LM hashes increase exposure.
Category: Risk
How can NTLM be hardened?
Enforce message signing, restrict NTLM via policy, audit usage, and prefer Kerberos wherever possible.
Category: Best practices
Is NTLM deprecated?
While widely discouraged in favor of Kerberos, NTLM persists for legacy compatibility; plan migrations to reduce reliance.
Category: Opinion
What is NTLMv2?
NTLMv2 improves security with stronger hashing and enhanced challenge–response; still vulnerable if signing isn’t enforced.
Category: Overview
How does NTLM’s challenge–response work?
The server issues a challenge; the client returns a response derived from the password hash, which the server validates.
Category: Example
What is a common misunderstanding about NTLM?
Some assume NTLM is secure by default; without signing and proper configuration, it is vulnerable to relays.
Category: Misunderstanding
How to detect NTLM usage?
Enable NTLM auditing policies and analyze security logs to identify systems and services relying on NTLM.
Category: Management
What is a competing authentication method to NTLM?
Kerberos provides stronger security, mutual authentication, and better delegation support in Active Directory environments.
Category: Alternatives