NTLM
A challenge-response authentication protocol used by Windows before Kerberos and still present as a fallback. The client proves knowledge of a password hash without sending the password, but the hash itself is sufficient to authenticate, which is the root of pass-the-hash and relay attacks.
NTLM has no mutual authentication in its common configurations and no binding between the authentication and the channel it travels over, so an attacker who can coerce a machine to authenticate to them can often relay that authentication elsewhere. Microsoft has been working to remove it from Windows for years. Most environments still cannot disable it, because some application, appliance, or hard-coded script depends on it, and finding those dependencies is the actual project.
See also: Kerberos, Active Directory, lateral movement, credential manager key extraction
Related on Start with Identity
- GlossaryLDAP
Lightweight Directory Access Protocol. A protocol for querying and modifying a hierarchical directory of entries, each identified by a distinguished name. Used
- GlossaryRADIUS
RADIUS (Remote Authentication Dial-In User Service) is a protocol, defined in [RFC 2865](https://www.rfc-editor.org/info/rfc2865/), that network devices such as
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- GlossaryAttack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid c
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl