Cybersecurity has changed dramatically over the past two decades, yet one attack technique continues to appear in penetration tests and real-world breaches: the NTLM relay attack. Security professionals have known about this weakness for years, Microsoft has introduced newer authentication methods, and many organizations have upgraded their infrastructure. Even so, attackers still succeed by exploiting systems that rely on outdated configurations rather than software flaws alone.
To understand why these attacks remain effective, it helps to answer a common question: What is NTLM? The answer explains not only how Windows authentication evolved but also why organizations continue to struggle with legacy protocols that refuse to disappear.
What Is NTLM and Why Is It Still Used?
What is NTLM? NTLM, or NT LAN Manager, is Microsoft’s challenge-response authentication protocol introduced in the early 1990s. Instead of sending a user’s password across the network, the client proves knowledge of the password by responding to a cryptographic challenge from the server.
At the time, this represented a meaningful improvement over plaintext authentication. NTLM became deeply integrated into Windows networking, supporting file sharing, printers, remote management, and countless enterprise applications.
Although Kerberos replaced NTLM as Microsoft’s preferred authentication protocol with Windows 2000 Active Directory, NTLM remains available for compatibility. Many organizations still depend on legacy applications, standalone systems, workgroup environments, or devices that cannot support Kerberos. As a result, NTLM continues to handle authentication in situations where modern alternatives are unavailable or improperly configured.
Microsoft has steadily encouraged organizations to reduce NTLM usage in favor of stronger authentication methods. Even so, completely removing NTLM remains difficult because business-critical applications often depend on it.
Why NTLM Relay Attacks Continue to Succeed
An NTLM relay attack does not require attackers to crack passwords. Instead, they intercept an authentication request and forward it to another system that accepts NTLM credentials without verifying the original client.
The weakness lies in trust rather than encryption. If a target service accepts relayed authentication without requiring additional protections, the attacker can impersonate the legitimate user for that session.
Several factors explain why these attacks remain common:
- Legacy systems still require NTLM for compatibility.
- Many servers do not enforce SMB signing or LDAP signing.
- Network segmentation is often incomplete, allowing attackers to reach multiple services.
- Users can unknowingly trigger authentication requests through phishing emails, malicious documents, or compromised websites.
These conditions frequently appear together in enterprise environments, creating opportunities that attackers can exploit with readily available security testing tools.
According to Microsoft’s security guidance and multiple incident reports, organizations continue to discover NTLM relay vulnerabilities during internal assessments because configuration weaknesses often persist long after infrastructure upgrades.
How an NTLM Relay Attack Works
A relay attack involves several distinct stages, none of which require the attacker to know the victim’s password.
- The attacker convinces a user or device to authenticate to a malicious server.
- The malicious server captures the NTLM authentication exchange.
- Instead of attempting to decrypt the credentials, the attacker forwards the authentication request to another trusted server.
- If the destination server accepts the relayed authentication, it grants access using the victim’s identity.
This process succeeds because traditional NTLM authentication does not always verify that the authentication response originated from the expected client. Unless additional protections such as SMB signing or Extended Protection for Authentication are enabled, the receiving server cannot distinguish a legitimate authentication attempt from a relayed one.
Modern penetration testing frameworks can automate much of this process, making relay attacks accessible even to attackers with moderate technical skills.
What Is NTLM? Why Legacy Authentication Creates Modern Risks
Many IT professionals still ask, “What is NTLM?” because they encounter it unexpectedly while investigating authentication logs or reviewing security assessments.
The challenge is not that NTLM itself contains a simple coding flaw. Instead, the protocol was designed for an earlier era of network security, when internal corporate networks were generally considered trustworthy.
Today’s enterprise environments look very different. Hybrid cloud deployments, remote work, third-party integrations, and increasingly sophisticated attackers have changed the threat landscape. Authentication protocols originally designed for isolated local networks now operate across far more complex environments.
Security researchers regularly identify relay opportunities during Active Directory assessments because organizations often focus on patching software vulnerabilities while overlooking authentication hardening. Relay attacks frequently exploit configuration weaknesses rather than unpatched operating systems.
Microsoft has also introduced security features such as LDAP signing, SMB signing, Credential Guard, and Extended Protection for Authentication to reduce these risks. Their effectiveness, however, depends on organizations enabling and properly configuring them throughout the environment.
Why Organizations Have Difficulty Eliminating NTLM
Removing NTLM completely sounds straightforward, but reality is far more complicated.
Many businesses continue running legacy applications developed years ago. These systems may depend entirely on NTLM and cannot easily be updated without replacing expensive software or disrupting business operations.
Embedded devices present another challenge. Older multifunction printers, storage appliances, industrial control systems, and network equipment often support only NTLM authentication. Replacing every incompatible device can require significant investment.
Large enterprises also manage thousands of servers and workstations across multiple business units. Identifying every NTLM dependency demands extensive testing because disabling the protocol too quickly may interrupt critical services.
Industry surveys consistently show that many organizations continue using legacy authentication protocols well beyond their intended lifespan because compatibility concerns outweigh short-term security improvements.
Reducing the Risk of NTLM Relay Attacks
Completely eliminating NTLM may not be practical for every organization, but reducing exposure is achievable through layered security controls.
Effective defensive measures include enforcing SMB signing, requiring LDAP signing, enabling Extended Protection for Authentication, limiting NTLM usage wherever possible, and adopting Kerberos or certificate-based authentication for supported services. Network segmentation also limits an attacker’s ability to relay credentials between systems.
Monitoring plays an equally important role. Security teams should review authentication logs for unusual NTLM activity, unexpected relay attempts, and authentication requests crossing network boundaries where they would not normally occur.
Regular penetration testing remains valuable because relay vulnerabilities often result from configuration issues that automated vulnerability scanners may overlook.
Final Analysis
NTLM relay attacks remain effective because they exploit trust relationships and legacy configurations rather than broken encryption. Organizations have spent years strengthening endpoint security and patching software vulnerabilities, yet authentication infrastructure often receives less attention despite playing a central role in enterprise security.
Answering the question “What is NTLM?” reveals why this decades-old protocol continues to appear in modern security incidents. NTLM was designed for a very different computing environment, and many organizations still depend on it because replacing legacy systems is costly and complex.
The continued success of NTLM relay attacks highlights an important lesson in cybersecurity: outdated protocols can remain a significant risk long after better alternatives exist. Reducing that risk requires more than software updates. It depends on careful configuration, ongoing monitoring, and a gradual transition toward stronger authentication methods that better match today’s security landscape.