DataTerminology.comNEW
Also known as: NTLM Hash
A legacy Windows authentication scheme using MD4-based password hashes, vulnerable to modern attacks and largely replaced by Kerberos or NTLMv2.
DESCRIPTION
NTLM Windows hashing refers to the storage and use of MD4-derived password hashes for NTLM authentication in Windows environments. While NTLM provides challenge–response authentication, the underlying hashes are susceptible to offline cracking and pass-the-hash attacks if compromised. Best practice disables LM hashes, prefers NTLMv2, and transitions to Kerberos where possible. Defense includes credential guard, restricted admin, and strong password policies. NTLM remains for legacy interoperability but is considered weak compared to modern approaches.
ALTERNATIVE DEFINITIONS
Microsoft Learn
NT LAN Manager (NTLM) is a challenge/response authentication protocol used to authenticate clients and servers.
Emphasizes challenge–response mechanism in Windows environments.
MITRE ATT&CK
Adversaries may use pass the hash (PtH) to authenticate to a remote service using the underlying NTLM or LanMan hash of a user’s password.
Highlights a prominent attack technique leveraging NTLM hashes.
RELATED TERMS
LM Hash Active Directory Challenge–Response Authentication Password Hashing Pass-the-Hash Attack Windows Hello for Business
COMPETING TERMS
Kerberos NTLMv2
RELATIONS
- Broader: Hashing
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure
TARGET AUDIENCE
Cybersecurity Engineer Security Architect Chief Information Security Officer IT Auditor IT Manager
EXTERNAL SOURCES
- Wikipedia - NTLM
- Microsoft - Guidance to restrict NTLM usage
- Microsoft - Kerberos overview as NTLM alternative
- IETF RFC 1320 - MD4 message-digest specification
TOP QUESTIONS
Why is NTLM Windows Hashing considered weak today?
Its MD4-based hashes are fast to brute-force and enable pass-the-hash attacks if credentials are exposed.
Category: Risk
What is the recommended alternative to NTLM Windows Hashing?
Kerberos is preferred in Active Directory domains; NTLMv2 is better than NTLM but still legacy.
Category: Recommendation
How can organizations mitigate NTLM Windows Hashing risks?
Restrict NTLM, enforce strong passwords, enable Credential Guard, and limit administrative credential exposure.
Category: Best practices
When is NTLM Windows Hashing still used?
Legacy systems or cross-compatibility scenarios may require NTLM where Kerberos cannot be used.
Category: Relevancy
What is pass-the-hash in the context of NTLM Windows Hashing?
It’s using a captured NTLM hash directly for authentication without knowing the plaintext password.
Category: Example
Does disabling LM hashes help with NTLM Windows Hashing security?
Yes. LM is weaker; ensuring LM is disabled and NTLMv2 is used reduces risk.
Category: Management
Can NTLM Windows Hashing be encrypted at rest?
Yes, but encryption does not prevent pass-the-hash when the system uses the hash; reduce exposure and privileges.
Category: Misunderstanding
How does Kerberos improve on NTLM Windows Hashing?
Kerberos uses tickets and mutual authentication, reducing reliance on reusable password hashes on endpoints.
Category: Comparison
What monitoring detects NTLM Windows Hashing abuse?
Track NTLM traffic, failed authentications, lateral movement patterns, and unusual use of administrative shares.
Category: Detection