2

Kerberos authentication is used in modern Windows AD domains, but I still see a lot of references to NTLM authentication.

Therefore, I would like to know the use cases for NTLM authentication. Are there some scenarios where NTLM authentication is always used?

Improve this question
  • 1
    We are always glad to help, but a question of this nature would probably be more appropriate within the Server Fault community. – Run5k Jul 17 '18 at 17:20
  • Do you just want information on Kerberos vs NTLM in a Windows environment, or do you have a specific situation or circumstance you're dealing with on the subject? If the former, there is ample documentation both from Microsoft and others comparing and contrasting the two and detailing their use cases. If the latter, please edit your question to make this clear. – music2myear Jul 17 '18 at 17:44
  • IMO this isn't ready for migration to SF. It would probably get closed there as too broad. – I say Reinstate Monica Jul 28 '18 at 2:41
2

NTLM is still used for computers that are members of a workgroup as well as local authentication. In an Active Directory domain environment, however, Kerberos authentication is preferable. For backward compatibility reasons, Microsoft still supports NTLM. Since a non-Microsoft or Microsoft application might still use NTLM.

From Windows Server 2003, Kerberos has been suggested rather than NTLM as it’s a stronger authentication protocol which uses mutual authentication rather than the NTLM challenge/response method.

However, with group policy we can disable the older NTLM and only allow Kerberos, this is known as NTLM blocking. Before doing this however, you should check and ensure that both Microsoft and third- party applications in your network do not require NTLM authentication before proceeding.

Improve this answer
  • Thank you! What is this group policy setting called? When you refer to NTLM authentication, you mean the challenge/response protocol with Net-NTLMv2 hashes? – Shuzheng Jul 18 '18 at 15:12
  • 1
    The policy is located at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options where you can find network security:restrict NTLM. And yes, NTLM is a challenge-response authentication protocol which uses hashed password values – V_V Jul 19 '18 at 2:13
  • 1
    If you select any of the deny options in gp, incoming NTLM traffic to the domain will be restricted. Then, set the Network Security: Restrict NTLM: Audit NTLM authentication in this domain policy setting, and then review the Operational log to understand what authentication attempts are made to the member servers. – V_V Jul 19 '18 at 2:20
0

While V_V is accurate about Kerberos being preferred and recommended, NTLM is still heavily used even in AD environments. There are many use cases where Kerberos does not work, such as accessing resources by IP, web traffic via load balancers (requires special Kerb config), some clustering, and SQL, much cross forest traffic.

Improve this answer
  • Just to be sure, NTLM authentication is the challenge/response protocol that results in Net-NTLMv1/v2 hashes? So, accessing Windows shares by IP results in NTLM authentication? Why doesn't Kerberos work? Will it work in the future? – Shuzheng Jul 18 '18 at 15:06
  • There version of the NTLM determines different types of math used. The hash itself is never transmitted, though NTLMv1 is weak enough to brute force over night on specialized hardware (crack.sh link ) . Kerberos depends on every service/server being registered with AD. As names don't change much, they are mostly registered automatically. Change too much for automatic stuff to go well. With the correct perms, you can register SPNs, as they are called, for the IPs. A computer object would have the right to register its own SPN, or the computer object owner, or a domain admin – markgamache Jul 19 '18 at 15:54
  • Why do you mention names (SPNs) here? – Shuzheng Jul 20 '18 at 17:18
  • SPNs are the cornerstone of Kerberos. They identify what account a service is tied to so that the right key material can be used. blogs.msdn.microsoft.com/autz_auth_stuff/2011/04/28/… – markgamache Jul 21 '18 at 18:46
  • The example you listed where Kerberos does not work is not the fault of the Kerberos protocol, but a bad implementation by the administrator. But yes, if the admin didn't correctly setup the infrastructure, authentication may fall back to NTLM. – Daniel Sep 22 '20 at 11:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.