Microsoft plans to kill off NTLM authentication in Windows 11

Post by hackmiester » Mon, Oct 16, 2023, 4:13 PM UTC

jeroenhd wrote: post #12

gustavus wrote: post #8

I felt a great disturbance in the force as if thousands of pen-testers and grey hats cried out in agony as their go to means of breaking enterprise networks was lost.

Don't worry, that printer from 2003 the CEO has an emotional connection to probably requires the entire network to keep NTLM enabled. The moment Microsoft rolls out a "turn NTLM back on" checkbox, the internet will be flooded with "how to fix printer not working on Windows 11" articles that will linger at least as long as the stupid "just disable SELinux if you run into any kind of error" articles are sticking around…

Post by wannacboatmovie » Mon, Oct 16, 2023, 4:14 PM UTC

jeroenhd wrote: post #16

wannacboatmovie wrote: post #10

Earlier quoted context omitted.

No. NTLM is an ancient protocol that dates back to Windows NT 3.1 in 1993. That's thirty years ago. Microsoft has been actively telling customers to "please stop using this" for over 10 years. Enough time has passed. NTLM is the Telnet of file sharing. There was a time and place for it and that time has passed.

Microsoft has said the same about SMB2 but people still turn that back on because of old NASes and printers. Most guides for Samba still seem to be written with NTLM in mind. Any Linux/*BSD based consumer NAS may break, as well as many hobbyist NAS setups. Microsoft is right to get rid of these old, vulnerable protocols, but there may still be an impact.

Post by 31337Logic » Mon, Oct 16, 2023, 4:22 PM UTC

sebstefan wrote: post #24

So for the uninitiated, what was the issue with NTLM that makes everyone happy they're switching to kerberos?

Post by philipov » Mon, Oct 16, 2023, 4:30 PM UTC

jeroenhd wrote: post #12

gustavus wrote: post #8

I felt a great disturbance in the force as if thousands of pen-testers and grey hats cried out in agony as their go to means of breaking enterprise networks was lost.

Don't worry, that printer from 2003 the CEO has an emotional connection to probably requires the entire network to keep NTLM enabled. The moment Microsoft rolls out a "turn NTLM back on" checkbox, the internet will be flooded with "how to fix printer not working on Windows 11" articles that will linger at least as long as the stupid "just disable SELinux if you run into any kind of error" articles are sticking around…

Post by pluto_modadic » Mon, Oct 16, 2023, 4:36 PM UTC

31337Logic wrote: post #25

sebstefan wrote: post #24

So for the uninitiated, what was the issue with NTLM that makes everyone happy they're switching to kerberos?

For the uninitiated, NTLM authn is so weak that you could break it just by sneezing near it.