Missiora
Windows Authentication: Kerberos vs NTLM

Technology Fundamentals

Windows Authentication: Kerberos vs NTLM

1 min readPublished 22 Jul 2026

Track your progress. Sign in to mark this guide complete and build your Job Readiness Score.

When you log into a Windows domain, one of two protocols proves who you are — modern Kerberos or legacy NTLM. Understanding both is essential for support and security roles alike.

Kerberos — ticket-based authentication

Interactive explainer

Kerberos Authentication

How Windows proves who you are without sending your password.

11. Authenticate (AS-REQ)22. Get a TGT33. Request a service ticket44. Access the service

Tap or hover a part to learn more.

1. Authenticate (AS-REQ)

Prove who you are.

At logon the client sends an Authentication Service Request to the Key Distribution Center (KDC) on a Domain Controller, encrypting a timestamp with a key derived from the user's password. The KDC verifies it — the password itself never crosses the network.

Check your understanding

1. What does the KDC issue after a successful logon?

2. Why must clocks be accurate for Kerberos?

Keep learning

Active DirectoryWindows Authentication CompTIA Security+
Practise this in AI Interview™

Kerberos never sends your password over the network. Instead the Key Distribution Center issues a Ticket-Granting Ticket (TGT), which you exchange for per-service tickets. Because tickets are time-stamped, accurate clocks (within ~5 minutes) are essential — clock skew is a classic cause of logon failure.

NTLM — the legacy fallback

Interactive explainer

NTLM Authentication

The legacy challenge-response protocol — and why it's risky.

11. Negotiate22. Challenge (nonce)33. Response44. Verify

Tap or hover a part to learn more.

1. Negotiate

Client asks to authenticate.

NTLM is Microsoft's older challenge-response protocol, used when Kerberos can't be (e.g. connecting by IP address, workgroup machines, or legacy apps). The client tells the server it wants to authenticate with NTLM.

Check your understanding

1. What attack is NTLM particularly vulnerable to?

2. When is NTLM typically used instead of Kerberos?

Keep learning

Windows AuthenticationActive Directory CompTIA Security+
Practise this in AI Interview™

NTLM is a challenge-response protocol used when Kerberos can't be — connecting by IP address, workgroup machines or legacy apps. It has no mutual authentication and is vulnerable to pass-the-hash attacks, so prefer Kerberos and disable NTLMv1.

Why it matters

Authentication issues are among the most common help-desk tickets, and understanding Kerberos vs NTLM is a favourite Security+ interview topic. It builds directly on Active Directory.

Interview Intelligence

How this topic actually shows up in interviews — and how to demonstrate you understand it.

Why employers ask about this

Authentication failures are everyday tickets, and pass-the-hash is a real-world attack. Employers check you understand how logon works and its security weaknesses.

Technical questions
Walk me through the Kerberos flow.+

AS-REQ to the KDC → TGT issued → present TGT for a service ticket → present service ticket to the service. The password never leaves the client.

Why is Kerberos preferred over NTLM?+

Mutual authentication, stronger crypto and ticket-based design; NTLM is vulnerable to pass-the-hash and lacks mutual auth.

Behavioural questions
Describe diagnosing a tricky authentication issue.+

STAR: symptoms, how you isolated cause (clock skew, group membership, NTLM fallback), and the fix.

Real-world scenarios
“Users intermittently fail to authenticate after a server rebuild.”+

Expected answer: Check time synchronisation first — Kerberos clock skew is a classic cause — then SPNs and DNS.

Common misconceptions

What candidates get wrong in interviews and on the job — and what strong professionals actually do.

Myth

'The password is checked by the server.'

Reality

Kerberos uses tickets; the DC/KDC validates, and the password never crosses the wire.

Myth

'NTLM is fine to leave enabled.'

Reality

NTLMv1 is weak and enables pass-the-hash — disable it where possible.

Practise in AI Interview™Rehearse these questions, scored.Plan with Career Coach™A personalised path to your goal.Evidence it in Career Passport™Prove this skill to employers.

Employability Intelligence

Where this knowledge takes you — the jobs, skills and certifications it feeds into.

Relevant roles
Help DeskSystems AdministratorSOC AnalystSecurity Engineer
Skills you're proving
KerberosNTLMTroubleshootingThreat awareness
Recommended certifications
CompTIA A+CompTIA Security+
Career progression

Help Desk → Sysadmin → Security Engineer.

What employers expect

That you can diagnose logon issues and articulate authentication security risks.

Frequently asked questions

Does Kerberos send my password to the server?

No. It uses tickets issued by the KDC; the password never crosses the network.

When is NTLM used instead of Kerberos?

When connecting by IP, in workgroups, or with legacy applications that don't support Kerberos.

Why do clocks matter for Kerberos?

Tickets are time-stamped; more than about five minutes of clock skew causes authentication to fail.

Related guides

Windows Fundamentals: Active Directory, Identity & AdministrationActive Directory Explained: Forests, Domains, OUs & ObjectsLDAP Explained: How Apps Query the DirectoryGroup Policy Explained: Configure Windows at Scale

Practise what you've learned

Turn this guide into real, evidenced progress

Missiora helps you measure, improve and evidence the capabilities employers actually value — start with the tools best suited to this topic.

M
Published by
Missiora

Missiora is an AI Employability Intelligence platform. Our resources are researched and reviewed by the Missiora team to help you measure, improve and prove your career readiness.

All resources