Loading story…
Microsoft announced a three-phase roadmap to reduce reliance on the legacy NTLM authentication protocol and ultimately disable NTLM by default in a future Windows release, pushing enterprises toward Kerberos-based authentication. The change is driven by NTLM’s long-documented weaknesses and exposure to common enterprise attack techniques including NTLM relay, replay, and pass-the-hash, which can enable unauthorized access to network resources when NTLM is used as a fallback.
The plan starts with Phase 1 (available now) focused on visibility and control via enhanced NTLM auditing to identify where NTLM is still in use. Phase 2 (targeted for the second half of 2026 / pre-release features) aims to reduce NTLM usage by removing migration blockers and improving Kerberos behavior in scenarios that currently fall back to NTLM (including mechanisms such as IAKerb and a local KDC, and updates to Windows components to prioritize Kerberos). Phase 3 will turn NTLM off by default while keeping it present in the OS for backward compatibility, allowing organizations to re-enable it via policy for legacy or NTLM-only dependencies during transition.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
As part of the roadmap, Microsoft said it intends in the second half of 2026 to reduce NTLM usage by removing migration blockers and enabling Kerberos in scenarios that currently fall back to NTLM, including capabilities such as IAKerb and a local KDC.
Microsoft announced a three-stage plan to move Windows environments away from NTLM toward Kerberos-based authentication, beginning with improved auditing and visibility, then reducing NTLM dependencies, and ultimately disabling NTLM by default in a future Windows Server release and associated Windows client.
Microsoft formally deprecated the NTLM authentication protocol in June 2024 and indicated it would no longer receive updates because of longstanding security weaknesses and legacy status.
In the final phase of the transition, Microsoft plans to disable NTLM by default in the next Windows Server release and a corresponding Windows client release, while still allowing administrators to re-enable it through policy for compatibility needs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft announced it will **disable NTLM by default** in future Windows releases, accelerating the retirement of the 30-year-old authentication protocol in favor of more secure, modern alternatives such as **Kerberos** and phishing-resistant, passwordless methods. NTLM remains widely used as a fallback when Kerberos is unavailable, but it relies on weak cryptography and is frequently abused for **NTLM relay** and **pass-the-hash** activity that can enable privilege escalation and domain compromise; the announcement highlights long-standing exploitation paths and coercion techniques associated with relay scenarios (e.g., *PetitPotam*, *ShadowCoerce*, *DFSCoerce*, *RemotePotato0*). Separately, Microsoft is moving Exchange Online toward **deprecating SMTP AUTH Basic Authentication** for all tenants, citing persistent abuse of basic-auth SMTP for **password spraying/brute force** and subsequent account takeover used to send phishing and spam. The change targets legacy workflows (devices, scripts, and third-party tools) that keep basic auth enabled and often bypass modern controls like **MFA** and **Conditional Access**; the referenced timeline indicates SMTP AUTH Basic Authentication remains available until **December 2026** to allow organizations to identify dependencies and migrate to stronger authentication methods.
Jun 29, 2026
Security researchers have highlighted ongoing exploitation and new vulnerabilities in the NTLM authentication protocol, which remains widely used in enterprise environments despite its well-known weaknesses. Recent research details multiple attack vectors, including hash leakage, coercion-based attacks, credential forwarding, and man-in-the-middle (MitM) techniques, as well as the continued use of NTLM in modern operating systems and legacy applications. Notable campaigns in 2025 have leveraged vulnerabilities such as CVE-2024-43451, CVE-2025-24054, and CVE-2025-33073 to deliver malware and conduct targeted attacks, particularly in Russia and Uzbekistan. Proof-of-concept exploits for NTLM elevation of privilege vulnerabilities have been released, further increasing the risk to organizations that have not yet migrated away from NTLM or implemented robust mitigations. Security experts recommend disabling or limiting NTLM, enabling message signing, and monitoring authentication logs to reduce exposure. The persistence of NTLM in critical infrastructure underscores the urgent need for organizations to transition to more secure authentication protocols and to remain vigilant against evolving exploitation techniques targeting NTLM weaknesses.
Jun 29, 2026
Microsoft has announced it will disable the legacy RC4 cryptographic cipher by default in Windows Kerberos authentication, marking a significant move to strengthen enterprise and government network security. The change, set to roll out in stages and be fully enforced by mid-2026, will require domain controllers on Windows Server 2008 and later to use stronger AES-SHA1 encryption by default. RC4 will only be permitted if explicitly configured by a domain administrator, addressing longstanding concerns about the cipher's vulnerabilities and its persistence due to legacy system dependencies. Security experts have highlighted that RC4's continued use has enabled numerous attacks, including high-profile breaches such as the compromise of health giant Ascension, which exposed millions of patient records. The decision to deprecate RC4 follows mounting criticism, including calls from US lawmakers for regulatory scrutiny over Microsoft's default support for the outdated cipher. The move is widely regarded as one of Microsoft's most significant cryptographic cleanups in years, forcing organizations to modernize authentication systems and reduce exposure to attacks like Kerberoasting that exploit RC4 weaknesses.
Jun 29, 2026