Microsoft Phases Out NTLM with 3-Stage Plan

Microsoft Begins NTLM Phase-Out With Three-Stage Plan to Move Windows to Kerberos

Microsoft has announced a three-phase approach to phase out New Technology LAN Manager (NTLM) as part of its efforts to shift Windows environments toward stronger, Kerberos-based options, following the formal deprecation of NTLM in June 2024. The move aims to mitigate security risks associated with NTLM, including replay, relay, and pass-the-hash attacks, which have been prevalent due to its weak cryptography.

Why This Matters

The technical reality of NTLM’s vulnerabilities, such as susceptibility to relay attacks and man-in-the-middle attacks, contrasts with ideal models of secure authentication protocols, highlighting the need for migration to more secure alternatives like Kerberos. The failure to migrate from NTLM can result in significant security risks and potential breaches, emphasizing the importance of Microsoft’s three-phase strategy to ensure a secure transition.

Key Insights

• NTLM was formally deprecated in June 2024 and no longer receives updates: Microsoft, 2024
• Kerberos provides stronger authentication and encryption compared to NTLM, making it a preferred choice for secure environments: Kerberos Documentation
• Microsoft’s three-phase plan includes enhanced NTLM auditing, addressing common roadblocks to migration, and disabling NTLM by default in future Windows releases: Microsoft, 2026

Working Example

# Example of enabling Kerberos authentication on Windows Server
Add-WindowsFeature RSAT-ADDS
Import-Module ActiveDirectory
Set-ADDomain -Identity "example.com" -KerberosEncryptionTypes AES128, AES256

Practical Applications

• Use Case: Microsoft’s own environment, where Kerberos is being prioritized for authentication to enhance security and mitigate NTLM-related risks.
• Pitfall: Failing to conduct thorough audits and mapping dependencies before migrating from NTLM to Kerberos, which can lead to authentication issues and security vulnerabilities.

References:

• https://thehackernews.com/2026/02/microsoft-begins-ntlm-phase-out-with.html
• https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
• https://www.microsoft.com/en-us/security/business/identity-access/kerberos