You eliminate NTLM authentication risk by auditing where the protocol still runs, disabling NTLMv1 and LM hash storage, enforcing SMB and LDAP signing to shut down relay attacks, and replacing NTLM logons with Kerberos or FIDO2 passwordless authentication so no reusable password hash exists to steal in the first place. Microsoft has been disabling NTLM by default since the Windows 11 24H2 builds, and by 2026 most current Windows Server and Windows 11 deployments ship with NTLM off unless an admin re-enables it for legacy compatibility. The catch: most enterprise networks still carry NTLM traffic from print servers, service accounts, and older applications nobody migrated, and blocking it outright before mapping those dependencies breaks authentication for systems your team forgot existed.
- Eliminate NTLM authentication risk in 2026 by auditing usage, killing NTLMv1, and enforcing SMB/LDAP signing against relay attacks.
- NTLM relay techniques like PetitPotam and PrinterBug still compromise Active Directory even when NTLM is restricted, not disabled.
- Passwordless authentication removes the reusable password hash NTLM depends on — the only permanent fix, not a workaround.
- Identity microsegmentation contains lateral movement if a hash gets stolen before your NTLM migration finishes.
Why this matters
NTLM authentication risk isn't a compliance checkbox. It's the most reliable path an attacker uses to move from one compromised laptop to domain admin, and it's been that way since NTLM hash-passing tools made lateral movement trivial for anyone with a foothold. NTLM's core weakness is structural: the protocol authenticates with a hash of a password, and that hash is reusable across the network. Steal it once, and you can authenticate as that user anywhere the hash is trusted, without ever cracking the actual password.
That's why Microsoft's own move to disable NTLM by default is significant. It's not a patch on top of NTLM — it's an admission the protocol can't be secured, only restricted and eventually retired. Enterprise security teams in 2026 are dealing with the messy middle: some systems already off NTLM, others still dependent on it, and attackers who know exactly where to look for the gap.
How do you eliminate NTLM authentication risk in an enterprise network?
Work through these steps in order. Skipping the audit step and jumping straight to restriction is the single most common cause of authentication outages during NTLM remediation projects.
- Audit NTLM usage before you touch anything. Enable the "Network security: Restrict NTLM: Audit NTLM authentication in this domain" Group Policy setting and let it run for at least one full business cycle. You need to see which servers, applications, and service accounts still call for NTLM before you disable anything.
- Kill NTLMv1 and LM hashes outright. Set the LAN Manager authentication level to "Send NTLMv2 response only, refuse LM & NTLM" wherever legacy device support allows it. NTLMv1 and LM hashes crack offline in minutes on commodity hardware.
- Turn on SMB signing and LDAP signing plus channel binding. This is what actually stops NTLM relay attacks — PetitPotam, PrinterBug, ShadowCoerce — from hijacking a captured hash mid-authentication instead of just cracking it later. Restricting NTLMv1 alone does nothing against relay.
- Restrict outbound NTLM with a deny list. Group Policy lets you block NTLM authentication to specific remote servers, forcing a fallback to Kerberos wherever it's supported. Roll this out server by server, not domain-wide, or you'll break things you can't see.
- Replace NTLM logons with passwordless authentication. FIDO2-based authentication removes the reusable hash NTLM depends on entirely, closing the vulnerability at its source instead of restricting around it. Enterprise-scale passwordless deployment is the step that actually ends the exposure rather than managing it.
- Contain what restriction doesn't reach. Even with NTLM locked down, a stolen credential can still move laterally through shared local admin rights and flat network segments. Identity microsegmentation for Active Directory environments stops a compromised hash from reaching systems it has no business touching.
- Monitor for pass-the-hash indicators continuously. NTLM migration in a large enterprise network commonly runs 12 to 18 months, and attackers exploit exactly that gap. Preventing pass-the-hash attacks in hybrid environments covers the detection signals that matter most during the transition window.
NTLM relay attacks: the risk restriction alone doesn't fix
Disabling NTLMv1 stops offline cracking. It does nothing against relay attacks, where an attacker coerces a machine into authenticating to a server they control and forwards that authentication to a target in real time. PetitPotam and PrinterBug both exploit this pattern against Active Directory Certificate Services, and both have been used in real ransomware intrusions. The fix is signing and channel binding, step three above — not a stronger NTLM version, because there isn't one coming.
Why NTLM risk varies across enterprise networks
No two organizations carry the same NTLM exposure. The factors that drive the difference:
- Legacy applications hardcoded to NTLM — older ERP systems, print servers, and embedded IoT connectors that were never built to negotiate Kerberos.
- Service accounts running scheduled tasks that assume NTLM's simpler handshake and break silently when it's restricted.
- Domain trusts and cross-forest authentication that fall back to NTLM whenever Kerberos delegation isn't explicitly configured.
- Devices outside the domain — BYOD laptops, IoT hardware, contractor endpoints — that can't participate in Kerberos ticketing at all.
- Directory sprawl from mergers and acquisitions, where duplicate Active Directory forests carry inconsistent NTLM policy enforcement across the combined estate.
- Compliance timelines that force a phased rollback instead of a hard domain-wide cutover, extending the exposure window.
“An NTLM hash captured today is a domain compromise waiting for lateral movement tomorrow.”
What happens after an NTLM hash is stolen
If a hash slips past your controls and an attacker moves laterally with it, the next step in most real intrusions is encryption or exfiltration, not quiet persistence. This is where NTLM risk stops being a pure identity problem and becomes a data resilience problem. Cyber Storage, Secfolio's ransomware-elimination architecture, encrypts data before it leaves the environment, shards it into fragments, and distributes those fragments across independent locations so no single system holds a reconstructable file. An attacker who reaches storage after a credential compromise finds unusable fragments, not files to encrypt or exfiltrate — a logical air gap that sits alongside identity controls rather than replacing them.
Is NTLM being retired in 2026?
NTLM is being phased out, not formally retired as a standard, but Microsoft has disabled it by default in newer Windows 11 and Windows Server builds as of 2026, and enterprise guidance now treats any remaining NTLM traffic as legacy debt to be eliminated on a timeline.
Does disabling NTLM break Active Directory authentication?
Disabling NTLM only breaks authentication for systems that depend on it and haven't been migrated to Kerberos or passwordless authentication, which is exactly why the audit step comes before any restriction in 2026 remediation projects.
What replaces NTLM authentication in enterprise networks?
Kerberos replaces NTLM for domain-joined system-to-system authentication, and FIDO2-based passwordless authentication replaces it for user logons, together removing the reusable password hash that makes NTLM exploitable.
Move users off NTLM for good
See how enterprise-scale passwordless rollout closes the gap NTLM restriction leaves open.
FAQ
How do you eliminate NTLM authentication risk?
You eliminate NTLM authentication risk by auditing NTLM usage, disabling NTLMv1 and LM hashes, enforcing SMB and LDAP signing against relay attacks, and migrating logons to Kerberos or passwordless authentication. Restriction alone reduces exposure; only removing the reusable hash eliminates it.
What is NTLM relay and why does restricting NTLM not stop it?
NTLM relay forwards a captured authentication attempt to a target server in real time instead of cracking the hash offline. NTLMv1 restriction stops offline cracking but not relay — only SMB and LDAP signing with channel binding blocks it.
Is NTLM being phased out in 2026?
Yes, Microsoft disables NTLM by default in current Windows 11 and Windows Server builds as of 2026, treating any remaining NTLM traffic in an enterprise network as legacy debt to remediate on a timeline.
Does disabling NTLM break existing applications?
Disabling NTLM breaks any application, service account, or device that was never migrated to Kerberos or passwordless authentication, which is why auditing NTLM usage always comes before restriction.
What replaces NTLM in an enterprise network?
Kerberos replaces NTLM for domain-joined authentication and FIDO2-based passwordless authentication replaces it for user logons, together removing the reusable password hash NTLM depends on.
How long does NTLM migration usually take?
NTLM migration in a large enterprise network commonly runs 12 to 18 months when staged by organizational unit rather than attempted as a single domain-wide cutover.
Can identity microsegmentation stop NTLM-based lateral movement?
Identity microsegmentation contains a stolen NTLM hash by blocking lateral authentication into segments it has no legitimate reason to reach, even while NTLM restriction and migration are still in progress.
What happens if an attacker steals an NTLM hash despite these controls?
A stolen NTLM hash typically leads to lateral movement toward ransomware deployment or data exfiltration, which is why data resilience architecture matters alongside identity controls, not instead of them.
One last thing
The enterprises that actually eliminate NTLM authentication risk in 2026 don't chase a single cutover date. They run auditing, restriction, and passwordless migration in parallel and stage enforcement by organizational unit, because NTLM traffic drops off gradually when it's forced out server by server, not all at once when a domain-wide switch gets flipped and half the help desk tickets come in by Monday morning.
Related guides
- How to prevent lateral movement in enterprise networks
- Attack path management for hybrid Active Directory and Entra ID
