Simple definition
Former challenge-response authentication mechanism still used in some Windows environments.
Technical definition
Former challenge-response authentication mechanism still used in some Windows environments. In a professional environment, this mechanism usually integrates with other services to ensure authentication compatibility when a service cannot use Kerberos.
What is it used for?
ensure authentication compatibility when a service cannot use Kerberos.
Practical example
access SMB toggle in NTLM when Kerberos Can’t get the right ticket.
Common issues
- poor resolution DNS to domain controllers
- Incoherent clock or authentication
- inherited configuration or duplicated object
Key takeaway: Always adapt the diagnosis to the product version and the architecture actually deployed.