NTLM Phase-Out: Microsoft's 3-Stage Plan to Move Windows to Kerberos

---

🔐 Executive Summary: The End of an Era for NTLM

After years of warnings, Microsoft has officially ignited the deprecation of NTLM (New Technology LAN Manager) with a concrete three-stage plan. This NTLM phase-out aims to replace the legacy protocol with Kerberos as the default authentication method in Windows. The move responds to decades of vulnerabilities, including pass-the-hash, relay attacks, and weak cryptography, that have made NTLM a favorite target for attackers. For cybersecurity professionals and IT teams, this transition is both a challenge and an opportunity to harden their identity infrastructure. This guide breaks down the plan, the risks, and exactly how to prepare.

Whether you're a student, a system administrator, or a CISO, understanding the NTLM phase-out is essential. Microsoft's roadmap includes enhanced auditing now, new features like IAKerb and local KDC in late 2026, and finally disabling NTLM by default in future Windows releases. Let's dive deep into what this means for your environment.

---

🛡️ Understanding NTLM and Its MITRE ATT&CK Techniques

NTLM is a challenge-response authentication protocol introduced by Microsoft in the early 1990s. It has long been considered insecure due to its use of weak cryptography (like LM/NTLM hashes) and vulnerability to multiple attack techniques documented in the MITRE ATT&CK framework.

Key techniques adversaries use against NTLM include:

• Pass-the-Hash (T1550.002): Attackers capture NTLM hashes (from memory or LSASS) and use them to authenticate without needing the plaintext password.
• NTLM Relay (T1557.001): Adversaries position themselves between a client and server to relay NTLM authentication, gaining unauthorized access to resources like SMB shares or Exchange.
• Credential Dumping (T1003.002): Tools like Mimikatz extract NTLM hashes from LSASS memory, enabling lateral movement.
• Man-in-the-Middle (T1557): Combined with ARP spoofing or rogue APs, attackers can downgrade authentication to NTLMv1 or capture exchanges.

---

⚙️ Why Microsoft is Forcing the NTLM Phase-Out

As Mariam Gewida from Microsoft stated, "NTLM is susceptible to various attacks, including replay and man-in-the-middle attacks, due to its use of weak cryptography." Despite being formally deprecated in June 2024, NTLM remains widely used in enterprises due to legacy applications, network constraints, or simple inertia. This exposes organizations to credential theft and lateral movement.

The shift to Kerberos brings modern security features: mutual authentication, ticket-based access, support for MFA, and resistance to replay attacks. Microsoft's three-stage plan ensures a secure-by-default future while providing tools to ease migration.

---

📅 Microsoft's Three-Stage NTLM Phase-Out Plan

Stage 1: Visibility & Control (Available Now)

Enhanced NTLM auditing allows administrators to log and analyze exactly where NTLM is still used. This includes which applications, servers, or clients are requesting NTLM authentication. Without this visibility, migration is impossible.

Stage 2: Addressing Roadblocks (Expected H2 2026)

Microsoft will introduce two key technologies to eliminate common blockers:

• IAKerb – allows Kerberos to work across trust boundaries and non-domain joined scenarios.
• Local KDC – a lightweight Key Distribution Center for local accounts and scenarios where a domain controller isn't reachable.
• Core Windows components will be updated to prefer Kerberos automatically.

Stage 3: Disabling NTLM by Default (Future Windows Release)

The next version of Windows Server and its associated Windows client will ship with NTLM network authentication disabled. Organizations can re-enable it via Group Policy if absolutely necessary, but the default state is secure.

---

👣 Step-by-Step Guide to Prepare for the NTLM Phase-Out

---

✅❌ Common Mistakes & Best Practices During NTLM Phase-Out

---

🎭 Red Team vs Blue Team: NTLM Phase-Out Impact

---

⚖️ Comparison: NTLM vs Kerberos

Feature	NTLM	Kerberos
Authentication type	Challenge-response (symmetric)	Ticket-based (asymmetric + symmetric)
Mutual authentication	No (server not authenticated to client)	Yes (both parties verify)
Resistance to replay	Weak (timestamps optional)	Strong (timestamps + session keys)
Pass-the-hash risk	High – hashes are sufficient	Low – requires ticket + session key
MFA support	Limited (NTLMv2 can leverage, but rarely used)	Native (with PKINIT, smart cards, Windows Hello)
Default in Windows	Legacy fallback	Domain-joined default

---

❓ Frequently Asked Questions About the NTLM Phase-Out

---

📌 Key Takeaways

• Microsoft's NTLM phase-out is real and accelerating: Phase 1 auditing is available now, Phase 2 mid-2026, Phase 3 (default disable) in a future Windows release.
• NTLM is associated with critical MITRE techniques like pass-the-hash (T1550.002) and relay (T1557.001), making its removal a major security win.
• Organizations must start auditing immediately to discover hidden NTLM dependencies.
• New technologies like IAKerb and local KDC will help bridge gaps for legacy apps.
• Red teams will lose a reliable attack vector; blue teams gain a more robust authentication foundation.

---

🚀 Start Your NTLM Phase-Out Journey Today