thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

NT LAN Manager (NTLM)

Legacy Microsoft challenge-response authentication protocol, now deprecated in favor of Kerberos.

Definition

NTLM authenticates without a third party by having the client encrypt a server challenge with a hash of the user's password. It lacks mutual authentication and is vulnerable to pass-the-hash and relay attacks. Microsoft has deprecated NTLM, and NTLMv1 has been removed from Windows 11 24H2 and Windows Server 2025.

Example

Group Policy 'Network security: Restrict NTLM' audits and blocks NTLM use across the domain.

Exam tip

NTLM is used as a fallback when Kerberos fails, e.g., accessing by IP address; plan to disable it.

Don't confuse it with

Related terms