Forced NTLM Authentication (Authentication Coercion) is an attack technique that tricks a system into sending NTLM authentication to an attacker-controlled listener. It is used to capture or relay credentials and authentication material, so defenders should reduce NTLM exposure, harden services that can be coerced, and monitor for unexpected outbound authentication attempts.
What Forced NTLM Authentication Means
Forced NTLM authentication, also called authentication coercion, is a technique that tricks a target into initiating NTLM authentication to an attacker-controlled listener. The attacker does not need to steal the password first, because the system itself can be induced to send usable authentication material.
This matters because NTLM was designed for compatibility, not modern resistance to relay and capture attacks. When a service or host can be coerced, the attacker can turn a normal authentication exchange into a credential-harvesting or relay opportunity.
Why This Technique Is Dangerous
The core danger is not simply that NTLM is present, but that some services will authenticate automatically in response to crafted network interactions. That makes forced authentication useful for collecting challenge-response material, relaying credentials to another service, or pivoting into additional access paths when stronger controls are absent.
In practice, coercion is often paired with name-resolution poisoning, remote service abuse, or exposed Windows services. NHIMG’s Lateral Movement Guide is useful here because it shows how ntlm relay and related Windows techniques fit into broader internal movement and service abuse patterns.
The danger increases when NTLM remains accepted on sensitive systems, especially where legacy compatibility, local admin access, or weak segmentation allows an attacker to reuse the coerced authentication against another endpoint.
How Organisations Check Exposure
Exposure review starts with knowing where NTLM is still enabled, which hosts can initiate outbound authentication, and which services are likely to accept relayed credentials. Asset inventory matters because coercion only becomes actionable when a reachable service, account, or trust path can be identified and used.
Teams should also review internet-facing or semi-trusted services that can be triggered remotely, especially file sharing, print-related services, remote management paths, and legacy Windows dependencies. Hardening guidance for these pathways is often best understood alongside broader directory and privilege review, as shown in the Active Directory and Entra ID Hardening Guide.
Vendor advisories and platform documentation are the right place to confirm which services can still be coerced and what mitigation options exist for the specific environment. Organisations should use those sources to validate where NTLM can be reduced, disabled, or constrained rather than relying on assumptions about default behaviour.
Detection, Containment, and Recovery
Detection usually focuses on unexpected outbound authentication, unusual NTLM traffic, and signs that a legitimate system is initiating authentication where it normally would not. The key is to distinguish normal service chatter from forced authentication patterns that appear after suspicious network interaction or coercion tooling.
Where credentials are captured or relayed, the post-exploitation review should include the accounts that authenticated, the target services that accepted the exchange, and any lateral movement that followed. Incident responders should treat session reuse, delegated access, and service account abuse as possible downstream effects, not just the original NTLM event.
Related breach cases help show the practical impact. In Cisco’s 2025 credentials leak, ntlm hashes, service accounts, and machine accounts became part of the abuse path, which is why Cisco Active Directory credentials leak 2025 is a useful reference point for the consequences of credential material exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1187 — Forced Authentication | This technique is a direct example of coercing authentication for adversary use. |
| Recommendation — Map coercion events to T1187 and hunt for unexpected outbound authentication and relay setup. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Forced NTLM abuse exploits authentication pathways that IA controls are meant to govern. |
| IA-5 — Authenticator Management | The technique depends on abused authentication material and how it is managed and protected. | |
| AC-17 — Remote Access | Coercion often becomes valuable when remote services or remote-auth paths are reachable. | |
| Recommendation — Enforce stronger authentication requirements and reduce legacy NTLM exposure for user access. Rotate, protect, and restrict authenticators and related secret material that NTLM abuse can expose. Restrict remote access paths that can be coerced into sending NTLM authentication. | ||
| CIS Controls v8 | 6 — Access Control Management | The attack relies on excessive or legacy access paths that should be reduced and controlled. |
| Recommendation — Limit legacy authentication paths and remove unnecessary access routes that enable coercion. | ||
Practitioner Guidance
Why practitioners should care: Forced NTLM authentication is a control-bypass technique, not just a protocol quirk. If legacy authentication is still accepted, an attacker may be able to turn ordinary service behaviour into a foothold for relay, impersonation, or follow-on access.
What to watch for: Pay close attention to systems that can be coaxed into authenticating outward, especially where help desk tooling, file/print features, or remote services are still active. Strong directory hardening and privilege boundaries reduce the value of a successful coercion attempt, and the MFA Guide helps frame why stronger authentication alone does not stop relay-style abuse.
Practitioner takeaway: Treat forced NTLM authentication as both a protocol exposure and a lateral-movement enabler, and verify that your detection logic can spot unexpected outbound authentication before it becomes a relay opportunity.
Related resources from NHI Mgmt Group
- Why does authentication coercion combined with NTLM relay create such a serious risk for AD CS?
- What is the difference between authentication coercion and NTLM relay in an Active Directory attack path?
- What breaks when one authentication method is forced across all identity types?
- Who should own the move from NTLM to certificate-based authentication?