thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

Kerberos vs NTLM: What's the Difference?

Kerberos is a ticket-based authentication protocol using a trusted third party (the KDC) and mutual authentication, and is the default in Active Directory. NTLM is an older challenge-response protocol that lacks mutual authentication and is vulnerable to pass-the-hash and relay attacks.

KerberosNTLM
MechanismTickets issued by a Key Distribution CenterChallenge-response using password hash
Mutual authenticationYesNo
Third partyKDC (AS and TGS) on domain controllersNone required, or DC pass-through
Time dependencyRequires synchronized clocks (default 5-minute skew)No time dependency
Common attacksGolden ticket, silver ticket, KerberoastingPass-the-hash, NTLM relay
StatusPreferred default in ADLegacy fallback, being phased out
Remember it

Kerberos uses tickets and clocks; NTLM uses hashes and hope.

Exam tip

Clock skew causing login failures points to Kerberos. Questions about pass-the-hash point to NTLM, while golden ticket attacks target Kerberos.

Tested on

More Security Fundamentals & Crypto look-alikes