NTLM  Authentication  Depreciation – What It Means

Last Updated on October 29, 2024 by Arnav Sharma

NTLM (New Technology LAN Manager) has been a cornerstone of Windows authentication for decades. However, as of June 2024, Microsoft officially deprecated all versions of NTLM, including LANMAN, NTLMv1, and NTLMv2. This means that while NTLM will still function in the next release of Windows Server and Windows annual updates, it will no longer receive any feature development or security improvements.

For organizations still relying on NTLM, this deprecation represents a critical inflection point. The risks of using outdated and less secure authentication protocols are significant. In this blog, we’ll explore the implications of NTLM’s deprecation, why transitioning to modern alternatives is essential, and how organizations can prepare for this shift.

What is NTLM?

NTLM, or New Technology LAN Manager, is an authentication protocol introduced by Microsoft to provide user authentication and integrity in earlier Windows operating systems. NTLM was widely used before Kerberos became the default in Windows 2000.

There are three key versions of NTLM:

• LANMAN (LAN Manager): The original version, considered obsolete due to its insecure handling of passwords.
• NTLMv1: An improvement over LANMAN but still considered weak by today’s standards.
• NTLMv2: The most secure version of NTLM, but still vulnerable compared to modern authentication protocols like Kerberos.

Why Microsoft is Deprecating NTLM

While NTLM has been in use for years, it was replaced by Kerberos as the default protocol starting with Windows 2000. Kerberos, which offers enhanced security features and performance, is now the preferred authentication mechanism for both Microsoft and many other platforms. NTLM’s deprecation is driven by several factors:

1. Security Concerns:
   • NTLM, especially earlier versions like LANMAN and NTLMv1, are highly vulnerable to modern cyberattacks. Attackers can exploit weaknesses in NTLM to execute pass-the-hash, brute force, or NTLM relay attacks, allowing unauthorized access to critical systems.
   • NTLM still relies on hash-based password storage, which can be compromised through advanced password cracking methods.
   • NTLM does not support modern security measures such as multi-factor authentication (MFA) or delegation.
2. Performance Limitations:
   • NTLM is slower compared to Kerberos. This is because NTLM requires several round-trips between the client and server to authenticate, whereas Kerberos uses ticketing which streamlines the process.
3. Lack of Modern Features:
   • NTLM lacks many advanced features such as delegation, where a service can impersonate a user to access resources, which is a key feature in Kerberos.
   • NTLM doesn’t handle multi-factor authentication natively, which is critical in today’s security-conscious world.

Microsoft’s Recommendation: Move to Negotiate or Kerberos

In light of these concerns, Microsoft recommends moving away from NTLM. Specifically, administrators are encouraged to switch to the Negotiate protocol, which prefers Kerberos but will fall back to NTLM only when absolutely necessary.

Negotiate is a security support provider (SSP) that chooses between Kerberos and NTLM based on availability and compatibility. When Kerberos is available (which it is by default in most modern Windows environments), Negotiate will use it, making the authentication process more secure and efficient.

What NTLM Depreciation Means for Organizations

The deprecation of NTLM has several key implications for IT administrators and security teams:

1. Security Risks:
   • Continuing to use NTLM after deprecation exposes organizations to significant security vulnerabilities, particularly NTLM relay attacks, where malicious actors trick a server into authenticating against a rogue system.
   • With NTLM no longer being actively developed, any newly discovered vulnerabilities may not be patched promptly, increasing the risk of exploitation.
2. Potential Breakage of Legacy Applications:
   • Many older or custom applications may still rely on NTLM. Replacing NTLM with Kerberos or Negotiate may require changes in the code or configurations, which could result in temporary service interruptions or compatibility issues.
3. End of Support:
   • Microsoft will continue to support NTLM in the near term, but future Windows releases may completely eliminate NTLM support. Organizations using NTLM must start planning for a long-term migration to avoid future disruptions.

Steps to Mitigate NTLM Risks

Organizations should begin planning for the transition away from NTLM as soon as possible. Here are the key steps:

1. Audit NTLM Usage in Your Environment

The first step is to identify where NTLM is still in use. This can be done by enabling auditing for NTLM authentication. Microsoft provides several Group Policy settings to help with this:

• Network Security: Restrict NTLM: Audit NTLM authentication in this domain
  • This setting helps administrators detect applications or services that are still using NTLM.

By enabling this setting, you can identify where NTLM is being used and develop a plan to transition these services to Kerberos or Negotiate.

2. Switch to Negotiate or Kerberos

For many applications, transitioning to Negotiate can be accomplished with a one-line change in the AcquireCredentialsHandle request to the Security Support Provider Interface (SSPI). Negotiate automatically prefers Kerberos, which provides a safer fallback path.

For other systems, you may need to reconfigure your authentication settings to use Kerberos directly. Ensure that both your domain controllers and client systems are configured to use Kerberos.

3. Evaluate Legacy Applications

Some older applications may only support NTLM. In these cases, you’ll need to evaluate the application’s importance and plan for either upgrading or replacing the application with a modern, Kerberos-compatible version.

4. Implement Multi-Factor Authentication (MFA)

Multi-factor authentication adds an additional layer of security by requiring users to provide two or more verification factors to access a resource. Since NTLM doesn’t natively support MFA, moving to Kerberos, which can integrate with MFA, is an essential security upgrade.

5. Educate IT Staff and Users

NTLM’s deprecation represents a significant change in how authentication will be managed in Windows environments. Make sure IT staff are trained in how to implement Kerberos and troubleshoot potential issues. Additionally, keep users informed about any service disruptions that might occur during the transition.

Alternatives to NTLM

Here are the main alternatives to NTLM:

1. Kerberos:
   • Kerberos is the default and most secure authentication protocol in modern Windows environments.
   • Provides strong cryptography and support for MFA.
   • Supports features like delegation, ticketing, and cross-realm authentication.
   • It is widely adopted by not only Microsoft but also Apple, Linux, UNIX, and other platforms.
2. Negotiate:
   • Negotiate is a wrapper around Kerberos and NTLM that automatically chooses the most secure protocol available. It defaults to Kerberos when possible, falling back to NTLM only when necessary.
   • Negotiate is ideal for environments where some applications still require NTLM, but administrators want to use Kerberos as much as possible.
3. Modern Identity Solutions:
   • Many organizations are adopting modern identity solutions such as Azure Active Directory (Azure AD), which supports OAuth2, OpenID Connect, and SAML, offering a more secure and flexible authentication mechanism for both cloud and on-premises resources.

Conclusion

NTLM’s deprecation is a necessary step in improving the security and performance of enterprise environments. While the protocol will continue to work for the next few Windows releases, it’s imperative for organizations to transition away from NTLM as soon as possible.

By switching to modern authentication protocols like Kerberos or Negotiate, organizations can protect themselves from NTLM vulnerabilities, improve authentication performance, and leverage advanced features like MFA and delegation.

If your organization is still using NTLM, now is the time to start planning your migration strategy. Identify applications that rely on NTLM, audit your network for NTLM usage, and prepare to switch to more secure alternatives like Kerberos.

FAQ: 

Q: What is Microsoft doing regarding deprecated features in cybersecurity for Windows 11 in 2023?

Microsoft has announced plans to deprecate the NT LAN Manager (NTLM) authentication protocol in favor of more secure alternatives, such as Kerberos. This shift aims to reduce the use of older, less secure protocols like NTLM, which are no longer under active development and are often abused in cyberattacks. NTLM will continue to be available in legacy systems but is being phased out for future versions of Windows, as Microsoft deprecates calls to NTLM in favor of Kerberos for authentication.

Q: How does Microsoft 365 integrate into the latest cybersecurity practices in Windows 11?

Microsoft 365 includes enhanced security features like Smart App Control, which allows developers to sign their apps and helps prevent unauthorized software from being executed on new Windows devices. This feature, along with the continued support for Kerberos authentication, strengthens the cybersecurity posture of Windows 11 and aligns with Microsoft’s efforts to deprecate NTLM usage.

Q: Why is Microsoft moving away from NTLM in favor of Kerberos?

NTLM, also known as NT LAN Manager, is being deprecated due to its vulnerability to cyberattacks. Microsoft plans to restrict NTLM usage and favor Kerberos authentication, which is more secure. Threat actors have abused NTLM in past cyberattacks, prompting Microsoft to focus on stronger encryption methods and authentication protocols like Kerberos, especially in Active Directory environments.

Q: What features in Windows 11 and Windows Server aim to replace NTLM?

Windows 11 and future versions of Windows Server are focusing on Kerberos authentication as the primary method. Microsoft is also enhancing tools like auditing tools and Active Directory Federation Services to work more securely without relying on NTLM. Microsoft Learn offers resources on the transition to Kerberos and restricting NTLM traffic in favor of more secure alternatives.

Q: How will the deprecation of NTLM affect Windows devices?

With NTLM being deprecated, Windows devices will increasingly rely on Kerberos authentication. However, NTLM will continue to be available as a fallback for older systems or in specific environments where NTLM traffic may still exist. In the future, newer Windows devices and the next annual release of Windows are expected to fully transition away from NTLM.