NTLM - NTLM and Kerberos

NTLM and Kerberos

Microsoft adopted Kerberos as the preferred authentication protocol for Windows 2000 and subsequent Active Directory domains. Kerberos is typically used when a server belongs to a Windows Server domain, or if a trust relationship with a Windows Server Domain is established in some other way (such as Linux to Windows AD authentication).

NTLM is still used in the following situations:

• The client is authenticating to a server using an IP address
• The client is authenticating to a server that belongs to a different Active Directory forest that has a legacy NTLM trust instead of a transitive inter-forest trust
• The client is authenticating to a server that doesn't belong to a domain
• No Active Directory domain exists (commonly referred to as "workgroup" or "peer-to-peer")
• Where a firewall would otherwise restrict the ports required by Kerberos (typically TCP 88)

In Windows Vista and above, neither LM nor NTLM are used by default. NTLM is still supported for inbound authentication, but for outbound authentication NTLMv2 is sent by default instead. Prior versions of Windows (back as far as Windows NT 4.0 Service Pack 4) could be configured to behave this way, but it was not the default.