Microsoft to Disable NTLM by Default as a Step Towards More Secure Authentication

Microsoft announced a three-phase roadmap to reduce and ultimately disable NTLM authentication by default in future Windows releases: Phase 1 (available now) for visibility and auditing, Phase 2 (second half of 2026) to reduce NTLM usage by preferring Kerberos, and Phase 3 to disable NTLM by default while retaining policy re-enablement for legacy support; the guidance urges organizations to audit NTLM usage, map application dependencies, and test NTLM-disabled configurations to minimize disruption.