NTLM pass-the-hash in Active Directory: are your controls enough?

TL;DR: Pass-the-hash remains one of the most direct lateral movement techniques in Active Directory because NTLM still caches reusable hashes in memory, allowing attackers to impersonate users without cracking passwords, according to IS Decisions. MFA alone does not stop protocol-level abuse, so access controls and monitoring now determine how far a foothold can spread.

Editorial analysis by NHI Mgmt Group, based on content published by IS Decisions: “Pass-the-Hash attacks explained”.

Key questions

Q: What breaks when NTLM is still enabled in Active Directory?

A: NTLM preserves a replayable trust path that attackers can abuse once they obtain cached hash material from a compromised endpoint.

Q: Why does pass-the-hash increase lateral movement risk so much?

A: Because it lets an attacker reuse a valid internal credential instead of hunting for a new one at every step.

Q: How can security teams know whether NTLM is still actually needed?

A: They should inventory applications, devices, and service accounts that still generate NTLM traffic, then test whether Kerberos, local KDC, or IAKerb can replace that dependency.

Practitioner guidance

• Inventory NTLM dependencies Map every application, server, and fallback path still using NTLM so you can see where pass-the-hash remains viable.
• Restrict administrative workstation use Block admins from using Remote Desktop or other privileged logins on endpoints that are not trusted, patched, and tightly monitored.
• Pair MFA with session controls Use MFA as a foothold-reduction control, then add concurrent session limits, contextual access rules, and prompt restrictions to limit what happens after authentication.

Bottom line: NTLM still creates a practical attack path because reusable hashes can be replayed inside the protocol even when the password is never recovered.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →