Lets Retire NTLM

NTLM is deprecated—and Windows is on a phased path toward NTLM being disabled by default—but most environments are nowhere near ready. This discussion walks through what current telemetry actually reveals about where NTLM is still hiding, why that matters, and why so many organizations incorrectly assume they’re safe.

In this session, Microsoft Principal Software Engineer Linda Taylor unpacks the common trap patterns we see in the field—unknown targets, SPN issues, IP-based access, and compatibility “knobs” that quietly re-enable risk—and shows why visibility, not blanket denial, is the key to making progress. Taylor outlines a practical playbook: audit → measure → prioritize → remediate → validate NTLM off, with lessons learned from real deployments. You’ll get a close look at upcoming Kerberos features that make NTLM truly unnecessary so you can plan a clean exit rather than a rushed one.