Microsoft® Windows® 2000 Security Handbook

Understanding NTLM

Why does Microsoft use this protocol at all? After all, there are far more effective protocols such as Kerberos that are already offered in Windows 2000. The primary reason, of course, is that most organizations need the backward compatibility that NTLM offers. We want to connect our Windows NT and Windows 95/98 machines to Windows 2000.

Although this eases the administrative overhead of using these legacy machines, it poses a problem because of its inherent weaknesses. The primary weakness consists of the ability to capture the challenge response hashes and crack the passwords of our users. I address this in the following section on the risks of using NTLM.

The NTLM Versions in Use

For now, let's discuss the background of ...