Nightmare On NTLM Street: Legacy’s Revenge

The talk follows a multi-year effort to retire LAN Manager and NTLM from a corporate Windows environment, a project that never reached its original goal. The speaker explains why these older authentication protocols are weak, covering cracking, relay and pass-the-hash attacks, and why Kerberos was meant to replace them. In practice the work stalled: authentication logs did not show where connections were headed, vendor support offered generic advice, and clients quietly fell back to NTLM whenever a direct path to a domain controller was missing.

The rollout proceeded in stages, starting with LM and NTLMv1 on workstations and then moving to servers. Testing by quietly changing settings and waiting for complaints surfaced legacy dependencies, and restarts had to be coordinated with an outside service provider. The final step, tightening domain controllers, went wrong when a misapplied setting locked staff out of the network on a Monday morning. A colleague reverted it after an overnight response, but the domain controllers were left accepting the older protocols.

The main takeaways are to map hidden dependencies and fallback paths before changing anything, enable detailed logging early, and communicate every change, especially when a major change coincides with personal absence. Technical guard rails matter more than relying on one person's care. The speaker also argues that blaming individuals slows recovery, and that a vendor keeping a weak protocol for compatibility shifts heavy work onto operators.