Notifications
Clear all
Topic starter
11/08/2026 3:16 pm
TL;DR: Pass-the-hash remains one of the most direct lateral movement techniques in Active Directory because NTLM still caches reusable hashes in memory, allowing attackers to impersonate users without cracking passwords, according to IS Decisions. MFA alone does not stop protocol-level abuse, so access controls and monitoring now determine how far a foothold can spread.
NHIMG editorial — based on content published by IS Decisions: NTLM pass-the-hash in Active Directory and what it means for security teams
Questions worth separating out
Q: What breaks when NTLM is still enabled in Active Directory?
A: NTLM preserves a replayable trust path that attackers can abuse once they obtain cached hash material from a compromised endpoint.
Q: Why does MFA not stop pass-the-hash attacks?
A: MFA protects the interactive login step, but pass-the-hash abuses the protocol after identity material has already been accepted.
Q: How can security teams reduce the chance of hash theft from Windows endpoints?
A: The most effective reduction comes from limiting local admin rights, restricting where administrators can log on, and protecting memory areas such as LSASS.
Practitioner guidance
- Map and remove NTLM fallback dependencies Identify applications, services, and legacy workflows that still rely on NTLM and set a phased retirement plan.
- Restrict privileged logons to trusted endpoints Block administrators from signing into unmanaged or high-risk workstations, especially where Remote Desktop is used.
- Harden LSASS and local admin exposure Apply controls that reduce credential access on endpoints, including least privilege for local admin rights and monitoring for suspicious memory access.
What's in the full article
IS Decisions' full post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step explanation of how NTLM caches hashes in memory and how PtH reuses them across services
- Examples of access controls such as MFA on UAC prompts, concurrent session limits, and context-based restrictions
- Discussion of when Remote Desktop and admin logons expose credential material on compromised hosts
- The article's comparison of NTLM fallback trade-offs versus Kerberos-based authentication
👉 Read IS Decisions' analysis of NTLM pass-the-hash and Active Directory risk →
NTLM pass-the-hash in Active Directory: are your controls enough?
Explore further
11/08/2026 3:29 pm
Pass-the-hash is a standing-credential problem, not just an authentication problem. NTLM allows identity material to persist in memory long enough to be replayed, which means the attack lives in the gap between login and session reuse. The important lesson for identity governance is that access can be stolen without ever being re-entered by the user. Practitioners need to treat any protocol that permits reusable authentication material as a lateral movement enabler.
A few things that frame the scale:
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%), according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, including 38% with no or low visibility and 47% with only partial visibility, according to Astrix Security & CSA.
A question worth separating out:
Q: How should teams respond when legacy authentication is still needed for compatibility?
A: Treat compatibility as a controlled exception, not a permanent state. Keep the number of NTLM-dependent services as small as possible, watch for abnormal session behaviour, and apply contextual access controls so that any residual fallback path is tightly constrained and observable.
👉 Read our full editorial: NTLM pass-the-hash shows why Active Directory controls still matter
