I understand that Kerberos is the recent authentication protocol used in windows environment and that NTLM is still supported for interoperability only. I want to know in non domain environments,if i am logging to my own pc at home which have windows 10,is the authentication carried by NTLM protocol or Kerberos ?

Also I want to know the NTLM use cases nowadays ?


When you type your password into the sign in screen on Windows for a local account it never leaves the machine. That means the NTLM (or Kerberos) protocol is never invoked. Domain accounts are different. They will attempt to verify against a cached login validator (strong one-way hash) first and then will attempt the network by trying Kerberos first and fall back to NTLM if it fails.

However, to complicate the explanation of things Windows bundles authentication protocols into packages and these packages are what provide sign in functionality to a machine whether its a local account or domain account. ALL sign ins flow through the NTLM package first and handed off to e.g. Kerberos for the actual processing.

Local accounts use the NTLM package to authenticate local users. That package is the thing that knows where password hashes and user metadata are stored.

So no protocols are involved during local user sign in.

  • so this means that NTLM is used for local accounts and kerberos for domain accounts?
    – 665bassem
    Apr 4 '20 at 14:34
  • What is the hash function?
    – LeWoody
    Apr 9 '20 at 15:56
  • PBKDF2 of password+salt. Parameters are dictated by specific version of OS (not just 10).
    – Steve
    Apr 9 '20 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.