MC1227478 – Advancing Windows security: Disabling NTLM by default

Product:

Windows, Windows Server

Platform:

Developer, Online, Windows Desktop, World tenant

Status:

Change type:

Admin impact

Links:

Details:

Windows is moving toward a more secure authentication model by phasing out New Technology LAN Manager (NTLM) in favor of stronger, Kerberos‑based alternatives. This transition is taking a three-phased approach, leading toward disabling NTLM by default in upcoming Windows releases. With each phase come new capabilities so that your organization has the tools, visibility, and compatibility support needed.

When will this happen:
NTLM has been deprecated since June 2024.
Today, enhanced auditing is available as part of Phase 1 toward NTLM disablement.
In the second half of 2026, new tools will be available to Windows Server 2025 and Windows 11, version 24H2 and later: IAKerb, Local KDC, upgrade to negotiate Kerberos.
With the next version of Windows Server and its corresponding client version, NTLM will be disabled by default. Additional support for handling NTLM-only cases will be built in.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2026-02-06

updated:
2026-02-06

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

Windows is transitioning from NTLM to the more secure Kerberos authentication method, with a phased approach to help organizations prepare and eventually disable NTLM by default in future releases.

Direct effects for Operations**

Disruption of Legacy Applications
Applications relying on NTLM for authentication may fail to function, leading to service interruptions and user frustration.
   - roles: Application Developers, IT Support Staff
   - references: https://learn.microsoft.com/windows-server/security/kerberos/ntlm-overview, https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-security-disabling-ntlm-by-default/4489526

Increased Support Tickets
Users may experience login issues or access problems, resulting in a surge of support requests and increased workload for IT support teams.
   - roles: Help Desk Technicians, System Administrators
   - references: https://support.microsoft.com/topic/overview-of-ntlm-auditing-enhancements-in-windows-11-version-24h2-and-windows-server-2025-b7ead732-6fc5-46a3-a943-27a4571d9e7b, https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-8-%E2%80%93-disabling-ntlm/4485782 " target="_blank" rel="nofollow noopener noreferrer">https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-8-%E2%80%93-disabling-ntlm/4485782

User Authentication Failures
Users may be unable to authenticate to services that have not transitioned to Kerberos, leading to productivity loss.
   - roles: End Users, Network Administrators
   - references: https://learn.microsoft.com/windows-server/security/kerberos/ntlm-overview, https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-security-disabling-ntlm-by-default/4489526

Increased Security Risks
Without proper preparation, disabling NTLM may expose the organization to security vulnerabilities if alternative authentication methods are not fully implemented.
   - roles: Security Analysts, Compliance Officers
   - references: https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-8-%E2%80%93-disabling-ntlm/4485782, https://learn.microsoft.com/windows-server/security/kerberos/ntlm-overview " target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/windows-server/security/kerberos/ntlm-overview

Operational Downtime
Critical services may experience downtime if dependencies on NTLM are not identified and remediated prior to the change.
   - roles: IT Operations Managers, Service Delivery Managers
   - references: https://support.microsoft.com/topic/overview-of-ntlm-auditing-enhancements-in-windows-11-version-24h2-and-windows-server-2025-b7ead732-6fc5-46a3-a943-27a4571d9e7b, https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-security-disabling-ntlm-by-default/4489526

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only