Blog Post

Windows IT Pro Blog
5 MIN READ

Advancing Windows security: Disabling NTLM by default

mariamgewida's avatar
mariamgewida
Icon for Microsoft rankMicrosoft
Jan 29, 2026
Windows is moving toward a more secure authentication model by phasing out New Technology LAN Manager (NTLM) in favor of stronger, Kerberos‑based alternatives. Let’s look at enhanced auditing and upc...
Timeline illustration showing enhanced auditing available today, then IAKerb, Local KDC, and upgrade hardcoded to negotiate occurring in the second half of 2026. The final phase, which occurs with the next version of Windows Server, shows NTLM disabled by default in most cases and the availability of unknown SPN, IP address, local accounts on domain machines, and new NTLM block policies.
Updated Jan 29, 2026
Version 3.0