Should organisations disable PDF scripting before tightening NTLM behaviour?

Why PDF scripting is the faster win in document-triggered authentication attacks

When a document can execute script or launch remote actions, it creates a more direct route to abuse than passive content alone. In this pattern, the document itself can become the trigger that reaches out, prompts credential use, or interacts with remote resources before an operator notices. That is why disabling scripting often reduces exposure faster than waiting for NTLM behaviour changes to take effect across every system.

NTLM hardening still matters because legacy environments may continue to accept or negotiate NTLM in ways that preserve relay, pass-the-hash, or downgrade-style exposure. But if the document is still allowed to execute active content, the organisation has left the most immediate trigger path intact, which means the attack can start before the authentication policy even becomes relevant.

In practice, the question is not which control is “better” in isolation. It is which one removes the most direct attack surface first. In a document-delivered attack, that is usually the scripting and remote-action capability embedded in the file format or reader workflow.

How the two controls complement each other

Disabling PDF scripting addresses the front end of the chain, while NTLM hardening addresses the identity protocol layer that may be abused if the trigger succeeds. Those layers are different, and they fail in different ways. A safer document configuration can stop the callback or authentication attempt entirely; stricter NTLM settings can limit what happens if a workstation or legacy application still makes the request.

The right sequence therefore depends on what is most exposed. If users regularly open untrusted documents, active content is the more immediate hazard because it can convert a simple view operation into network activity. If the environment still relies on older Windows integrations, print paths, or third-party applications that negotiate NTLM, protocol hardening remains an important containment measure.

For identity-heavy environments, this is the kind of layered control choice that benefits from basic hardening guidance such as Active Directory and Entra ID Hardening Guide, because the practical issue is not only configuration, but how document-open behaviour can intersect with legacy authentication paths.

What a sensible prioritisation looks like

Use a risk-first order: reduce document execution capability where you can, then tighten NTLM where the legacy footprint still requires it. That sequence lowers the chance that a malicious or booby-trapped PDF can even reach the authentication layer. If you reverse the order, you may spend time reducing protocol exposure while leaving the more easily triggered document path unchanged.

This is especially important where service accounts, domain relationships, or legacy trust paths still exist. A document that can provoke outbound authentication against internal resources can create opportunities for credential capture, relay, or validation of reachable hosts. The hardening guide for Windows identity estates is useful here because it reinforces that authentication exposure rarely exists in a single layer and often depends on how endpoint behaviour, delegation, and legacy protocols interact.

Where the attack pattern is tied to stolen or exposed directory material, Cisco Active Directory credentials leak 2025 is a useful reminder that credential material and authentication paths are often linked, but the initial trigger can still be a file-format feature rather than a direct protocol weakness.

Risk and Threat Considerations

Documents that can run scripts or reach out to remote content increase the chance of unintended authentication, credential exposure, or callouts to attacker-controlled infrastructure. Once that happens, NTLM weaknesses become easier to abuse because the attacker no longer needs to rely on the user taking an additional action after opening the file.

Failure mechanism: Active content in the PDF can generate outbound requests, initiate authentication, or interact with remote objects, creating a pathway for relay, credential capture, or coercive network traffic before NTLM policy controls can meaningfully intervene.

Impact: The organisation may face credential exposure, authentication abuse, lateral movement opportunities, or repeated callback traffic from endpoints that should have remained passive document viewers.

Practitioner Guidance

What to prioritise: If the goal is fastest risk reduction, disable or restrict PDF scripting and remote actions first, especially for users who open external or untrusted documents. That removes the most direct trigger for the attack pattern.

Decision rule: If you still depend on NTLM for legacy compatibility, harden it in parallel rather than instead of document controls. Treat NTLM tightening as the containment layer, not the primary way to stop a malicious document from starting the chain.

What to verify: Confirm which readers, mail clients, browsers, and endpoint policies can still permit active PDF behaviour, and verify whether any business process genuinely requires it. If not, remove it rather than relying on user caution.

Practitioner takeaway: In mixed legacy environments, the most effective order is usually to eliminate the document trigger first, then reduce the authentication exposure that remains.

Related resources from NHI Mgmt Group

• Should organisations block exploit behaviour before or after incident response?
• Should organisations prioritise NHI inventory before tightening PCI DSS controls?
• Should organisations centralise entitlement management before tightening cloud policy?
• Should organisations automate compliance reporting before tightening access governance?