Legacy authentication protocols like NTLM, SMBv1, and Basic Auth get discovered through sign-in logs, Windows security event IDs, and network traffic captures — then disabled through Conditional Access policies, Group Policy restrictions, and protocol removal at the OS or application layer. The catch: most enterprise networks can't kill legacy auth in one pass because a printer, a service account, or a third-party vendor integration still depends on it, and cutting it off blind breaks production.
- Detect and disable legacy authentication protocols using Windows event IDs 4624/4625 for NTLM and sign-in log filters for Basic Auth in 2026.
- NTLM and SMBv1 remain the two most common legacy auth protocols found in enterprise Active Directory environments today.
- Disabling legacy auth without an inventory phase breaks service accounts, printers, and vendor integrations first.
- Passwordless authentication removes the reusable credential that makes legacy auth exploitable in the first place.
Why this matters
Legacy authentication protocols don't support modern MFA. NTLM, unsigned LDAP binds, and Basic Auth over HTTP or IMAP all authenticate with a reusable secret and nothing else — no token, no phishing-resistant factor, no context check.
That gap is why attackers target legacy auth first. An adversary who harvests one NTLM hash or one set of Basic Auth credentials gets a foothold that bypasses every MFA policy the security team has already rolled out elsewhere. From there, the attack path runs straight into lateral movement: eliminating NTLM authentication risk closes one of the most common entry points into that path in 2026 environments.
How to detect and disable legacy authentication protocols
Detection and disabling happen in the same sequence for every protocol: find where it's used, confirm nothing production-critical breaks, then turn it off at the source. The table below maps the three protocols security teams encounter most.
| Protocol | Detection method | Disable method |
|---|---|---|
| NTLM | Event IDs 4624/4625 with authentication package field set to NTLM | Restrict NTLM via Group Policy, audit before enforce |
| SMBv1 | Get-SmbServerConfiguration or SMB session enumeration |
Remove the SMB1Protocol Windows feature |
| Basic Auth / unsigned LDAP | Entra ID sign-in logs filtered by client app; LDAP channel binding events | Disable Basic Auth in Exchange Online; enforce LDAP signing and channel binding |
Run detection in audit-only mode for 30 to 60 days before enforcing a block. That window surfaces every service account, scanner, and legacy application still authenticating the old way, so the disable step doesn't take down a production system nobody remembered was still using it.
NTLM: audit with event ID 4624 before you restrict it
NTLM authentication events log under ID 4624 (successful logon) and 4625 (failed logon), with the authentication package name field showing "NTLM" instead of "Negotiate" or "Kerberos." Filter domain controller security logs on that field to build an inventory of every device and account still falling back to NTLM.
Once the inventory is clean, set "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" to audit mode first, review the logs for a full patch cycle, then move to deny. Full NTLM elimination also closes the door on pass-the-hash attacks, which depend on the same reusable hash NTLM exposes.
SMBv1: confirm it's actually gone, not just unused
Microsoft removed SMBv1 by default starting with Windows 10 version 1709 and Windows Server 2019, but plenty of enterprise networks still carry it forward through legacy file servers, older NAS devices, and industrial equipment that never got reimaged. Run Get-SmbServerConfiguration on file servers and check EnableSMB1Protocol — a value of True means it's still live.
Disable it with Set-SmbServerConfiguration -EnableSMB1Protocol $false, then confirm no scheduled job or backup agent depended on it before the next maintenance window closes.
Basic Auth and unsigned LDAP: check Conditional Access sign-in logs
Basic Auth shows up in Entra ID sign-in logs under the "Client App" column as "Other Clients" or specific legacy protocols like POP, IMAP, or Exchange ActiveSync with basic authentication. Exchange Online has already deprecated Basic Auth for most protocols, but tenants with legacy app registrations can still slip through.
Unsigned LDAP binds against Active Directory get flagged in the Directory Service event log when LDAP channel binding and signing are enforced — Microsoft's 2020 and 2022 security advisories on this made enforcement the default recommendation, and most domains still running mixed enforcement do so because a line-of-business app breaks under signing.
Why legacy authentication protocols persist
Security teams rarely leave legacy auth on by choice. It survives because:
- Legacy applications hardcode NTLM or Basic Auth and were never rebuilt to support modern authentication.
- Printers, scanners, and IoT devices ship with Basic Auth or SMBv1 as the only supported protocol.
- Service accounts authenticate the same way they did a decade ago because nobody owns the migration project.
- Third-party vendor integrations require legacy protocols to interoperate with older on-prem systems.
- POP/IMAP mail clients still in use by a subset of staff depend on Basic Auth.
- Fear of breaking production delays enforcement long after audit logs show the risk.
Each of these is a credential exposure point that feeds directly into the broader attack path: a stolen NTLM hash or an intercepted Basic Auth password becomes the starting point for lateral movement across the network, widening the blast radius of a single compromised account. Replacing the underlying credential model — not just the protocol — is what closes that path for good. Implementing passwordless authentication at enterprise scale removes the reusable secret entirely, so there's no NTLM hash or Basic Auth password left for an attacker to capture in the first place.
Map your legacy auth exposure
See where NTLM and Basic Auth still create attack paths in your network.
FAQ
Is NTLM still used in 2026?
NTLM is still active in most enterprise Active Directory environments in 2026, usually through legacy applications, service accounts, and printers that were never migrated to Kerberos. Audit logs (event ID 4624/4625) are the fastest way to confirm how much NTLM traffic remains.
Does disabling legacy auth break anything?
Disabling legacy auth breaks anything still configured to use it, which is why audit mode always precedes enforcement. A 30 to 60 day audit window surfaces every dependent system before the block goes live.
What’s the difference between NTLM and Kerberos?
NTLM authenticates with a reusable password hash and no ticket system, while Kerberos issues time-limited tickets that expire and can’t be replayed the same way. Kerberos is the modern default; NTLM only fires when Kerberos fails or isn’t supported.
How do you detect legacy auth without breaking production?
Detect legacy auth by running every restriction policy in audit-only mode first, logging every account and device that still falls back to NTLM, SMBv1, or Basic Auth, then enforcing the block only after the dependent systems are identified and migrated.
Why is Basic Auth considered legacy authentication?
Basic Auth sends credentials with every request and has no native support for MFA, which is why Exchange Online and most modern identity platforms have deprecated it. Any protocol that authenticates on a static password alone counts as legacy auth in 2026.
Can passwordless authentication replace legacy auth entirely?
Passwordless authentication replaces the credential that legacy protocols depend on, which removes the exploitable secret even where a legacy protocol technically remains in use for compatibility. It doesn’t eliminate NTLM or SMBv1 by itself — protocol-level disabling is still required.
What Windows event ID shows NTLM authentication?
Event ID 4624 logs a successful logon and event ID 4625 logs a failed one; the authentication package field in either event shows "NTLM" when legacy authentication was used instead of Kerberos.
One last thing
Most security teams treat legacy auth cleanup as a one-time project. It isn't — every new vendor integration, every legacy device refresh, and every acquired subsidiary reintroduces NTLM or Basic Auth somewhere in the environment. Build the detection query once, in 2026, and re-run it quarterly rather than closing the ticket and moving on.
Related guides
- Migrate from passwords to FIDO2 without disrupting users
- Stop credential theft in Active Directory environments
