{"id":1300439,"date":"2023-11-22T19:19:00","date_gmt":"2023-11-22T19:19:00","guid":{"rendered":"https:\/\/www.businesstelegraph.co.uk\/microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic\/"},"modified":"2023-11-22T19:19:00","modified_gmt":"2023-11-22T19:19:00","slug":"microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic","status":"publish","type":"post","link":"https:\/\/www.businesstelegraph.co.uk\/microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic\/","title":{"rendered":"Microsoft Improves Windows Security with a Path to Move Off NTLM &#8211; TechRepublic"},"content":{"rendered":"<p> <script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<!-- newscabal uk text -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:inline-block;width:728px;height:90px\"\r\n     data-ad-client=\"ca-pub-8162386273903324\"\r\n     data-ad-slot=\"3688094655\"><\/ins>\r\n<script>\r\n(adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><br \/>\n<\/p>\n<div id=\"\">\n<p>NTLM is a simple and straightforward authentication method for connecting to applications on enterprise servers, but it\u2019s also outdated and insecure. Despite that, NLTM is still widely used, partly because of inertia but also because the preferred replacement Kerberos doesn\u2019t currently cope with some important scenarios.<\/p>\n<p>Now Microsoft plans to extend Kerberos in the versions of Windows and Windows Server that will ship in the next two years to help organizations move off NTLM. Here\u2019s what will change and how to prepare.<\/p>\n<p>Jump to:<\/p>\n<h2 id=\"what\">What is NTLM?<\/h2>\n<p>NTLM is an authentication protocol that lets a client connect to a server with a username and password. It\u2019s easy to implement and use, and it doesn\u2019t need a connection to the domain controller or a central database of accounts and permissions.<\/p>\n<p>The name gives away just how old NTLM is: The New Technology LAN Manager arrived in Windows NT 3.1 in 1993 \u2013 30 years ago. Even the slightly more secure NTLM v2 dates back to Windows 2000.<\/p>\n<h2 id=\"whats\">What\u2019s wrong with NTLM?<\/h2>\n<aside class=\"pinbox right\">\n<h3 class=\"heading\">Must-read Windows coverage<\/h3>\n<\/aside>\n<p>The NTLM username and password are encrypted, and the NTLM protocol makes sure the server checks that the username and password match. But although the response to the server is sent using fairly secure MD5 encryption, passwords are stored in the security account manager or NTDS file on the domain controller using much weaker MD4 cryptography, and password hashes aren\u2019t salted (adding random data to passwords makes it harder to spot duplicate passwords).<\/p>\n<p>There is no server authentication in NTLM, so the client can\u2019t be sure it\u2019s connecting to the server it expects rather than a malicious imitation. Plus, there have been<a href=\"https:\/\/blog.compass-security.com\/2020\/05\/relaying-ntlm-authentication-over-rpc\/\" target=\"_blank\" rel=\"noopener\"> bugs in the way Windows uses NTLM<\/a>.<\/p>\n<p>That all makes NTLM vulnerable to a range of attacks, from intercepting and reusing credentials to attack other servers (man-in-the-middle, relay and pass-the-hash attacks) to simply cracking passwords. Eight-character NTLM passwords, which is the standard in many organizations, can be brute forced in just three minutes using consumer-grade hardware. And NTLM doesn\u2019t have the option to use modern credentials like biometrics, multifactor authentication or FIDO keys; you\u2019re stuck with passwords.<\/p>\n<h2 id=\"why\">Why is NTLM still used?<\/h2>\n<p>Kerberos, which has better cryptography and server authentication, lets you use those modern credentials like Windows Hello for Business, instead of sticking with passwords; officially, it should already be the primary authentication option in Windows.<\/p>\n<p>However, despite its age, insecurity, design flaws and general poor performance compared to Kerberos, NTLM is still widely used, with trillions of authentication messages sent on Windows systems every day. Sometimes that\u2019s because of legacy applications that haven\u2019t been updated or just the complexity of dealing with Kerberos. But more often, it\u2019s because there are common enterprise network situations that Kerberos doesn\u2019t currently handle.<\/p>\n<p>For years, Microsoft\u2019s official guidance has been to use SPNEGO, an IETF-standard mechanism in Windows for negotiating what authentication protocol to use that\u2019s often just called <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/secauthn\/microsoft-negotiate\" target=\"_blank\" rel=\"noopener\">Negotiate<\/a> and always tries to use Kerberos first \u2013 but that can still mean falling back to NTLM in some cases. For example, if you have workgroups with local user accounts, where the user is authenticated directly by the application server, Kerberos won\u2019t work.<\/p>\n<p>Local user accounts are very common in enterprises \u2013 many environments rely on them, like the <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/laps\/laps-overview\" target=\"_blank\" rel=\"noopener\">Windows Local Administrator Password Solution<\/a> for managing local administrator account passwords<a href=\"https:\/\/www.techrepublic.com\/article\/protect-passwords-local-administrator-solution\/\"> Microsoft shipped last year<\/a>. In<a href=\"https:\/\/www.youtube.com\/watch?v=SEtARCtGP0Y\" target=\"_blank\" rel=\"noopener\"> a recent online technical session<\/a>, principal developer Steve Syfuhs from Microsoft\u2019s Windows Cryptography, Identity and Authentication team said local users make up almost a third of all NTLM usage.<\/p>\n<p>Other common issues are machine-to-machine authentication, like SMB or RDP and legacy domains.<\/p>\n<p>With Kerberos, the client that\u2019s connecting to an application server needs to be able to first connect to the Kerberos Key Distribution Center, a service that runs on the Active Directory domain controller. If you\u2019re accessing an SMB server from outside the enterprise network, the firewall or the topology of a complex internal network may mean you can\u2019t connect to the KDC and have to fall back to NTLM. VPNs don\u2019t help here, because the VPN still needs to connect to the domain controller.<\/p>\n<p>Similarly, although all the Remote Desktop services in Windows Server 2019 and above <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/remote\/remote-desktop-services\/clients\/rdp-files\" target=\"_blank\" rel=\"noopener\">already support Kerberos<\/a>, the way Remote Desktop Services is usually set up can also force it to fall back to NTLM. That\u2019s because the quite sensible focus on securing remote access can mean the domain controller isn\u2019t visible to RDS, so it can\u2019t use Kerberos for authentication. Older RDP clients, especially on devices that aren\u2019t running Windows, may also need to fall back to NTLM.<\/p>\n<p>If you use Microsoft Entra ID, which Azure Active Directory is now called, that doesn\u2019t use NTLM. But if you use Microsoft Entra Connect or Entra Connect cloud sync to access on-premises resources, and Kerberos can\u2019t be negotiated because of network topology or a misconfiguration, you will be falling back to NTLM.<\/p>\n<h2 id=\"how\">How is Microsoft extending Kerberos to fully replace NTLM?<\/h2>\n<p>This \u201cline of sight\u201d problem is only responsible for about 5% of NTLM usage, but Microsoft is introducing an extension to the Kerberos protocol called<a href=\"https:\/\/k5wiki.kerberos.org\/wiki\/Projects\/IAKERB\" target=\"_blank\" rel=\"noopener\"> Initial and Pass Through Authentication Using Kerberos<\/a> that will address it without organizations needing to reconfigure networks.<\/p>\n<p>The client that wants to authenticate to the server application may not be able to reach the KDC on the network, but the server can because it needs to connect to the domain controller to do NTLM. IAKerb takes the Kerberos message that would normally go directly to the KDC over port 88, wraps it in the Negotiate protocol and sends it to the application server to forward to the KDC and then wraps the response in the same way and sends it back to the client.<\/p>\n<p>IAKerb doesn\u2019t help with local users, because when the application server does the authentication itself, it\u2019s not written to hand that over to a backend service like KDC. But you can have the application server handle the Kerberos messages itself by running the KDC code that\u2019s usually only on your domain controller running on other Windows Server systems (and Windows clients), using the local SAM and AeS encryption.<\/p>\n<p>Microsoft calls this local KDC, and you don\u2019t need to open new ports or worry about running DNS, netlogon or DCLocator to make it work.<\/p>\n<p>Kerberos also fails with domains that are misconfigured, and around 14% of NLTM usage is, but that\u2019s a problem you\u2019ll have to solve yourself, not least because if you\u2019re connecting to an unknown server, then you\u2019re connecting to a server without knowing if you can trust it.<\/p>\n<h2 id=\"how-can\">How can I get ready to move off NTLM?<\/h2>\n<p>Just over half of NTLM usage is for applications that hardcode in using NTLM. If you\u2019ve done that in your own applications, you\u2019ll need to update the application: There aren\u2019t any shims or workarounds that Microsoft can do in Windows. But it turns out that some services in Windows, especially ones using RPC, also hardcode using NTLM: Microsoft will change those to use Negotiate instead, getting rid of a substantial amount of NTLM usage by default.<\/p>\n<p>Both IAKerb and local KDC will be part of the Negotiate protocol inside Windows, so Windows will always try to use Kerberos first, relying on IAKerb as necessary. If that doesn\u2019t work, it will fall back to the local KDC. If that doesn\u2019t work either, NTLM will still be there as the ultimate fallback for compatibility \u2013 at least for this first phase.<\/p>\n<p>If you\u2019re already using Negotiate, you won\u2019t need to make any changes to take advantage of IAKerb and local KDC when you upgrade to versions of Windows that include them. If you\u2019re not using Negotiate, <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/windows-it-pro-blog\/the-evolution-of-windows-authentication\/ba-p\/3926848#:~:text=For%20application%20developers%2C%20audit%20code%20for%20hardcoded%20usage,the%20RpcBindingSetAuthInfo%20function%20and%20replace%20%E2%80%9CRPC_C_AUTHN_DEFAULT%E2%80%9D%20with%20%E2%80%9CRPC_C_AUTHN_GSS_NEGOTIATE%E2%80%9D.\" target=\"_blank\" rel=\"noopener\">updating applications to use Negotiate instead of NTLM is relatively straightforward<\/a> and doing that before the new features ship will show you whether you need to rely on them.<\/p>\n<p>You may find systems that don\u2019t work with Kerberos because they aren\u2019t configured with Service Principal Names or that use IP addresses instead of DNS names. Kerberos doesn\u2019t work with IP addresses by default because these are so likely to change over time, but you can already<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/security\/kerberos\/configuring-kerberos-over-ip\" target=\"_blank\" rel=\"noopener\"> set a policy to allow IP addresses to be used for Kerberos<\/a>.<\/p>\n<p>If you find compatibility issues with IAKerb and local KDC in your environment, there will be policies to turn them off or configure which applications, services and individual servers can continue to use NTLM and which you want to block NTLM on.<\/p>\n<p>In the long run, Microsoft wants to phase out NTLM completely, and that will include the password hashes currently stored in SAM and NTDS on the domain controller. But like the deprecation of SMB1 in Windows, you can expect this to take multiple years, with lots of warning and opportunities for feedback. As with SMB1, you can expect NTLM to move through stages of being deprecated, being disabled by default but with Group Policy to turn it back on, not being installed by default and finally<a href=\"https:\/\/techcommunity.microsoft.com\/t5\/storage-at-microsoft\/smb1-now-disabled-by-default-for-windows-11-home-insiders-builds\/ba-p\/3289473\" target=\"_blank\" rel=\"noopener\"> being fully removed<\/a> and only available as a feature on demand.<\/p>\n<h2 id=\"find\">Find out where you\u2019re using NTLM<\/h2>\n<p>Making authentication more secure in Windows starts with finding out where you use NTLM to prepare for shifting to Kerberos. This will be particularly important if you have non-Windows devices that authenticate to applications running on Windows Server or if you use open source software like Samba. Like Negotiate, IAKerb is being standardised through the IETF so other software vendors can work with it and with local KDC; but they may need time to add support and you need to know if that work is relevant to you because it could mean you will continue to see NTLM in your network.<\/p>\n<p>In fact, tools and settings for blocking NTLM were <a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2008-R2-and-2008\/dd560653(v=ws.10)?redirectedfrom=MSDN\" target=\"_blank\" rel=\"noopener\">introduced in Windows 7 and Windows Server 2008 R2<\/a> in 2012, but given how widely NTLM is used, few organizations will have been able to remove it entirely. You can use the Network Security: Restrict NTLM: Audit incoming NTLM traffic security policy (look in Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options in Group Policy) to<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/threat-protection\/security-policy-settings\/network-security-restrict-ntlm-audit-incoming-ntlm-traffic\" target=\"_blank\" rel=\"noopener\"> audit your NTLM use<\/a> \u2013 make sure the event viewer logs are large enough because there\u2019s probably enough traffic to fill them up more quickly than you expect.<\/p>\n<p>Although you can turn on NTLM auditing in Group Policy now, Microsoft is extending the information that will be included to make it easier to tell which applications are using NTLM. At the moment, you get the process ID, but in the future, it will show the specific EXE that\u2019s associated with it, because that may not be visible in the log.<\/p>\n<p>Once you have the detailed information about which applications, services and servers are using NTLM, you can start creating granular policies to control that and gradually replace it with Kerberos.<\/p>\n<h2 id=\"when-will\">When will the Kerberos extensions be available?<\/h2>\n<p>As usual, the changes will roll out in new versions of Windows 11 and Windows Server first in 2024 and 2025 respectively, and server applications like IIS will be updated to support IAKerb once the feature ships.<\/p>\n<p>The option to<a href=\"https:\/\/techcommunity.microsoft.com\/t5\/storage-at-microsoft\/smb-ntlm-blocking-now-supported-in-windows-insider\/ba-p\/3916206\" target=\"_blank\" rel=\"noopener\"> block Windows from allowing NTLM authentication for SMB<\/a> is also coming to Windows 11, starting with Windows 11 Insider Preview Build 25951, which shipped to the Canary channel this September.<\/p>\n<p>Once those new releases come out, Microsoft may or may not backport these features to versions of the OS that are already shipping. It\u2019s not clear whether IAKerb and Local KDC will come to Windows 10, due to the amount of work involved and the end of support for Windows 10 in 2025. Making major changes like this always runs the risk of compatibility issues for older applications.<\/p>\n<p>That makes it even more important to take advantage of the NTLM auditing tools to discover how and where you\u2019re using NTLM and how quickly you can move away from it.<\/p>\n<\/p><\/div>\n<p><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-8162386273903324\"\r\n     data-ad-slot=\"7859258044\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><br \/>\n<br \/><a href=\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/\">READ SOURCE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>NTLM is a simple and straightforward authentication method for connecting to applications on enterprise servers, but it\u2019s also outdated and insecure. Despite that, NLTM is still widely used, partly because of inertia but also because the preferred replacement Kerberos doesn\u2019t currently cope with some important scenarios. Now Microsoft plans to extend Kerberos in the versions [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1300440,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_oct_exclude_from_cache":false,"footnotes":""},"categories":[53],"tags":[],"class_list":["post-1300439","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Microsoft Improves Windows Security with a Path to Move Off NTLM - TechRepublic - Business Telegraph<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft Improves Windows Security with a Path to Move Off NTLM - TechRepublic - Business Telegraph\" \/>\n<meta property=\"og:description\" content=\"NTLM is a simple and straightforward authentication method for connecting to applications on enterprise servers, but it\u2019s also outdated and insecure. Despite that, NLTM is still widely used, partly because of inertia but also because the preferred replacement Kerberos doesn\u2019t currently cope with some important scenarios. Now Microsoft plans to extend Kerberos in the versions [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/\" \/>\n<meta property=\"og:site_name\" content=\"Business Telegraph\" \/>\n<meta property=\"article:published_time\" content=\"2023-11-22T19:19:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"businesstelegraph\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"businesstelegraph\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic\/\"},\"author\":{\"name\":\"businesstelegraph\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78\"},\"headline\":\"Microsoft Improves Windows Security with a Path to Move Off NTLM &#8211; TechRepublic\",\"datePublished\":\"2023-11-22T19:19:00+00:00\",\"dateModified\":\"2023-11-22T19:19:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic\/\"},\"wordCount\":2017,\"publisher\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg\",\"articleSection\":[\"security\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic\/\",\"url\":\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/\",\"name\":\"Microsoft Improves Windows Security with a Path to Move Off NTLM - TechRepublic - Business Telegraph\",\"isPartOf\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg\",\"datePublished\":\"2023-11-22T19:19:00+00:00\",\"dateModified\":\"2023-11-22T19:19:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#primaryimage\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg\",\"contentUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg\",\"width\":800,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.businesstelegraph.co.uk\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Microsoft Improves Windows Security with a Path to Move Off NTLM &#8211; TechRepublic\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#website\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/\",\"name\":\"Business Telegraph UK\",\"description\":\"business, tech and industry news\",\"publisher\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.businesstelegraph.co.uk\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\",\"name\":\"Business Telegraph UK\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png\",\"contentUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png\",\"width\":500,\"height\":177,\"caption\":\"Business Telegraph UK\"},\"image\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78\",\"name\":\"businesstelegraph\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/author\/businesstelegraph\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft Improves Windows Security with a Path to Move Off NTLM - TechRepublic - Business Telegraph","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/","og_locale":"en_GB","og_type":"article","og_title":"Microsoft Improves Windows Security with a Path to Move Off NTLM - TechRepublic - Business Telegraph","og_description":"NTLM is a simple and straightforward authentication method for connecting to applications on enterprise servers, but it\u2019s also outdated and insecure. Despite that, NLTM is still widely used, partly because of inertia but also because the preferred replacement Kerberos doesn\u2019t currently cope with some important scenarios. Now Microsoft plans to extend Kerberos in the versions [&hellip;]","og_url":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/","og_site_name":"Business Telegraph","article_published_time":"2023-11-22T19:19:00+00:00","og_image":[{"width":800,"height":600,"url":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg","type":"image\/jpeg"}],"author":"businesstelegraph","twitter_card":"summary_large_image","twitter_misc":{"Written by":"businesstelegraph","Estimated reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#article","isPartOf":{"@id":"https:\/\/www.businesstelegraph.co.uk\/microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic\/"},"author":{"name":"businesstelegraph","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78"},"headline":"Microsoft Improves Windows Security with a Path to Move Off NTLM &#8211; TechRepublic","datePublished":"2023-11-22T19:19:00+00:00","dateModified":"2023-11-22T19:19:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.businesstelegraph.co.uk\/microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic\/"},"wordCount":2017,"publisher":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#organization"},"image":{"@id":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#primaryimage"},"thumbnailUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg","articleSection":["security"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/www.businesstelegraph.co.uk\/microsoft-improves-windows-security-with-a-path-to-move-off-ntlm-techrepublic\/","url":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/","name":"Microsoft Improves Windows Security with a Path to Move Off NTLM - TechRepublic - Business Telegraph","isPartOf":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#primaryimage"},"image":{"@id":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#primaryimage"},"thumbnailUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg","datePublished":"2023-11-22T19:19:00+00:00","dateModified":"2023-11-22T19:19:00+00:00","breadcrumb":{"@id":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#primaryimage","url":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg","contentUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/11\/Microsoft-Improves-Windows-Security-with-a-Path-to-Move-Off.jpg","width":800,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/www.techrepublic.com\/article\/microsoft-improves-windows-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.businesstelegraph.co.uk\/"},{"@type":"ListItem","position":2,"name":"Microsoft Improves Windows Security with a Path to Move Off NTLM &#8211; TechRepublic"}]},{"@type":"WebSite","@id":"https:\/\/www.businesstelegraph.co.uk\/#website","url":"https:\/\/www.businesstelegraph.co.uk\/","name":"Business Telegraph UK","description":"business, tech and industry news","publisher":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.businesstelegraph.co.uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.businesstelegraph.co.uk\/#organization","name":"Business Telegraph UK","url":"https:\/\/www.businesstelegraph.co.uk\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/","url":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png","contentUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png","width":500,"height":177,"caption":"Business Telegraph UK"},"image":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78","name":"businesstelegraph","url":"https:\/\/www.businesstelegraph.co.uk\/author\/businesstelegraph\/"}]}},"_links":{"self":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts\/1300439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/comments?post=1300439"}],"version-history":[{"count":0,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts\/1300439\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/media\/1300440"}],"wp:attachment":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/media?parent=1300439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/categories?post=1300439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/tags?post=1300439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}