Why does Microsoft still use LM/NTLM for hashing of password? Why are they not using more secure algorithms for hashing like BCRYPT or SHA512?
Two reasons: backwards compatibility and threat model assessment. Microsoft uses Kerberos over the open Internet, but NTLM within a network. The reasoning is that if your network has already been pwned, using a more secure algorithm offers no benefit. Internal applications also within an organization also tend to run older versions of the OS (XP, mostly), so allowing NTLM lets corporations to continue to use their older hardware and software.