Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit ba89b4b · +13 −22 lines · also on GitHub
11
---
2
−title: NTLM Overview
3
−description: Learn about NTLM, any changes in functionality, and find links to technical resources to Windows Authentication and NTLM for Windows Server.
2
+title: NTLM overview in Windows Server
3
+description: Learn about NTLM, and find links to technical resources to Windows Authentication and NTLM for Windows Server.
44
ms.topic: article
55
ms.assetid: 773909fd-c0bc-498a-95fc-bb452ec04d90
66
ms.author: mosagie
77
author: robinharwood
88
manager: mtillman
9
−ms.date: 09/21/2023
9
+ms.date: 04/17/2025
1010
---
11
−# NTLM Overview
11
+# NTLM overview
1212
1313
This topic for the IT professional describes NTLM, any changes in functionality, and provides links to technical resources to Windows Authentication and NTLM for Windows Server.
1414
15
−## <a name="BKMK_OVER"></a>Feature description
16
−NTLM authentication is a family of authentication protocols that are encompassed in the Windows Msv1\_0.dll. The NTLM authentication protocols include LAN Manager version 1 and 2, and NTLM version 1 and 2. The NTLM authentication protocols authenticate users and computers based on a challenge\/response mechanism that proves to a server or domain controller that a user knows the password associated with an account. When the NTLM protocol is used, a resource server must take one of the following actions to verify the identity of a computer or user whenever a new access token is needed:
17
−
18
−- Contact a domain authentication service on the domain controller for the computer's or user's account domain, if the account is a domain account.
15
+NTLM authentication is a family of authentication protocols that are encompassed in the Windows Msv1_0.dll. The NTLM authentication protocols include LAN Manager version 1 and 2, and NTLM version 1 and 2. The NTLM authentication protocols authenticate users and computers based on a challenge response mechanism that proves to a server or domain controller that a user knows the password associated with an account. When the NTLM protocol is used, a resource server must take one of the following actions to verify the identity of a computer or user whenever a new access token is needed:
1916
20
−- Look up the computer's or user's account in the local account database, if the account is a local account.
17
+- Contact a domain authentication service on the domain controller for the computer's or user's account domain, if the account is a domain account.
2118
22
−## <a name="BKMK_APP"></a>Current applications
23
−NTLM authentication is still supported and must be used for Windows authentication with systems configured as a member of a workgroup. NTLM authentication is also used for local logon authentication on non\-domain controllers. Kerberos version 5 authentication is the preferred authentication method for Active Directory environments, but a non\-Microsoft or Microsoft application might still use NTLM.
19
+- Look up the computer's or user's account in the local account database, if the account is a local account.
2420
25
−Reducing the usage of the NTLM protocol in an IT environment requires both the knowledge of deployed application requirements on NTLM and the strategies and steps necessary to configure computing environments to use other protocols. New tools and settings have been added to help you discover how NTLM is used in order to selectively restrict NTLM traffic. For information about how to analyze and restrict NTLM usage in your environments, see [Introducing the Restriction of NTLM Authentication](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd560653(v=ws.10)) to access the Auditing and restricting NTLM usage guide.
21
+## Current applications
2622
27
−## <a name="BKMK_NEW"></a>New and changed functionality
28
−There are no changes in functionality for NTLM for Windows Server.
23
+NTLM authentication is still supported and must be used for Windows authentication with systems configured as a member of a workgroup. NTLM authentication is also used for local logon authentication on non-domain controllers. Kerberos version 5 authentication is the preferred authentication method for Active Directory environments, but a non-Microsoft or Microsoft application might still use NTLM.
2924
30
−## <a name="BKMK_DEP"></a>Removed or deprecated functionality
31
−There is no removed or deprecated functionality for NTLM for Windows Server.
25
+Reducing the usage of the NTLM protocol in an IT environment requires both the knowledge of deployed application requirements on NTLM and the strategies and steps necessary to configure computing environments to use other protocols. New tools and settings have been added to help you discover how NTLM is used in order to selectively restrict NTLM traffic. For information about how to analyze and restrict NTLM usage in your environments, see [Introducing the Restriction of NTLM Authentication](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd560653(v=ws.10)) to access the Auditing and restricting NTLM usage guide.
3226
33
−## <a name="BKMK_INSTALL"></a>Server Manager information
34
−NTLM cannot be configured from Server Manager. You can use Security Policy settings or Group Policies to manage NTLM authentication usage between computer systems. In a domain, Kerberos is the default authentication protocol.
27
+## Related content
3528
36
−## <a name="BKMK_LINKS"></a>See also
3729
The following table lists relevant resources for NTLM and other Windows authentication technologies.
3830
3931
|Content type|References|
4032
|--------|-------|
41
−|**Product evaluation**|[Introducing the Restriction of NTLM Authentication](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd560653(v=ws.10))<p>[Changes in NTLM Authentication](/previous-versions/windows/it-pro/windows-7/dd566199(v=ws.10))|
42
−|**Planning**|[IT Infrastructure Threat Modeling Guide](/previous-versions/tn-archive/dd941826(v=technet.10))<p>[Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP](/previous-versions/tn-archive/dd162275(v=technet.10))<p>[Threats and Countermeasures Guide: Security Settings in Windows Server 2008 and Windows Vista](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd349791(v=ws.10))<p>[Threats and Countermeasures Guide: Security Settings in Windows Server 2008 R2 and Windows 7](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh125921(v=ws.10))|
43
−|**Deployment**|[Extended Protection for Authentication](/dotnet/framework/wcf/feature-details/extended-protection-for-authentication-overview)<p>[Auditing and restricting NTLM usage guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/jj865674(v=ws.10))<p>[Ask the Directory Services Team : NTLM Blocking and You: Application Analysis and Auditing Methodologies in Windows 7](https://blogs.technet.com/askds/archive/2009/10/08/ntlm-blocking-and-you-application-analysis-and-auditing-methodologies-in-windows-7.aspx)<p>[Windows Authentication Blog](https://blogs.technet.com/authentication/)<p>[Configuring MaxConcurrentAPI for NTLM pass-through authentication](https://support.microsoft.com/help/2688798/how-to-do-performance-tuning-for-ntlm-authentication-by-using-the-maxc)|
33
+|**Product evaluation**|[NTLM user authentication](/troubleshoot/windows-server/windows-security/ntlm-user-authentication)|
34
+|**Deployment**|[Extended Protection for Authentication](/dotnet/framework/wcf/feature-details/extended-protection-for-authentication-overview)<p>[Audit use of NTLMv1 on a Windows Server-based domain controller](/troubleshoot/windows-server/windows-security/audit-domain-controller-ntlmv1)<p>[Ask the Directory Services Team : NTLM Blocking and You: Application Analysis and Auditing Methodologies in Windows 7](https://blogs.technet.com/askds/archive/2009/10/08/ntlm-blocking-and-you-application-analysis-and-auditing-methodologies-in-windows-7.aspx)<p>[Windows Authentication Blog](https://blogs.technet.com/authentication/)<p>[Configuring MaxConcurrentAPI for NTLM pass-through authentication](https://support.microsoft.com/help/2688798/how-to-do-performance-tuning-for-ntlm-authentication-by-using-the-maxc)|
4435
|**Development**|[Microsoft NTLM \(Windows\)](/windows/win32/secauthn/microsoft-ntlm)<p>[\[MS\-NLMP\]: NT LAN Manager \(NTLM\) Authentication Protocol Specification](/openspecs/windows_protocols/ms-nlmp/b38c36ed-2804-4868-a9ff-8dd3182128e4)<p>[\[MS\-NNTP\]: NT LAN Manager \(NTLM\) Authentication: Network News Transfer Protocol \(NNTP\) Extension](/openspecs/windows_protocols/ms-nntp/73ae7d96-30fe-4750-807c-bfe7c38b3a0a)<p>[\[MS\-NTHT\]: NTLM Over HTTP Protocol Specification](/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a)|
4536
|**Updates**|[New NTLM pass-through authentication protections for CVE-2022-21857](/troubleshoot/windows-server/windows-security/windows-updates-add-new-ntlm-pass-through-authentication-protections)|
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.