Nightmare on NTLM street: Legacy’s Revenge#

Marina Bochenkova

• Why: Microsoft announced NTLM family deprecation in June 2024; every identity and infrastructure team will live through this migration. This is a field report of actually doing it, not a deprecation-recap.
• What: A retrospective of disabling NTLM in a mid-sized enterprise — why it survives 24 years past its replacement (application development lag, flaws in the replacement paths, decision-making, underfunded IT), plus resources and lessons learned for completing the removal elsewhere. (from abstract only)
• How: Deployment methodology rather than exploitation: dependency discovery, organizational blockers, and remediation strategy for phasing out NTLM (and similar legacy protocols).
• Where applicable: Enterprise AD environments broadly; the case study is one mid-sized enterprise (org-specific experience), but the dependency classes it documents are general.