The Evolution of Windows Authentication (eliminating NTLM)

Topic

New Reply

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-evolution-of-windows-authentication/ba-p/3926848

As Windows evolves to meet the needs of our ever-changing world, the way we protect users must also evolve to address modern security challenges. A foundational pillar of Windows security is user authentication. We are working on strengthening user authentication by expanding the reliability and flexibility of Kerberos and reducing dependencies on NT LAN Manager (NTLM)…

Our end goal is eliminating the need to use NTLM at all to help improve the security bar of authentication for all Windows users…

Reply | Quote

Replies

I have a bit of bad news about this announcement,

Regarding this statement:

• NTLM is the only protocol supported when using local accounts.

When they deprecate NTLM entirely in the future, unless they add a local Kerberos authority to Windows 11/12/13/14 (right now they are only planning to add a Kerberos “cache/proxy”) then peer to peer file sharing on small networks using local machine accounts will be broken forever.    I suspect they want everyone to use an online account, which can use MS as the authentication authority.

~ Group "Weekend" ~

1 user thanked author for this post.

windbg

Reply | Quote

I’ll ask around what are the plans for that use case.

Note that we will have businesses with ntlm needs for a long time so this is a LONG journey.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

NetDef

Reply | Quote

I’ll be interested in any info your sources can gather.  My internal source thinks its a few years out still, they want to measure NTLM use over time as they press application developers to stop hard coding it into their programs – but knowing how slow some large and expensive line of business applications move it may be a decade.

I’ll likely be fully retired by then. 

~ Group "Weekend" ~

Reply | Quote

Local KDC is the plan but as you and I both point out – this is going to be YEARS.  We will probably both be retired by then and we’ll have Elon chips in our heads.

Susan Bradley Patch Lady/Prudent patcher

2 users thanked author for this post.

NetDef, TechTango

Reply | Quote