In any "recent" documentation regarding NTLM (Microsoft) I see it stated that the mechanism of pass-through authentication is done over a NetLogon channel, which should be secure. This secure channel is also used to pass the session key from the Domain Controller to the server.

However, older information I have found, for example CIFS Logon and Pass Through Authentication, states that there is another mechanism with which a server can use the help of a Domain Controller to authenticate a user. This mechanism is described, essentially, as a man-in-the-middle operation, where the server just relays all messages between the client and Domain Controller for the authentication process.
Is this possible? In which scenarios? If so - how is the session key safely passed from the Domain Controller to the server in this case?

1 Answer 1


NTLM authentication has two methods: secure NetLogon channel and LanManager signing & sealing. The latter uses unencrypted relayed communications between clients, servers, and DCs, making it vulnerable to man-in-the-middle attacks, and no safe transmission of session keys occurs in this scenario.

  • So is the key transferred together with the authentication confirmation message or is session security just flat out unsupported in this case?
    – superstav
    Commented Feb 22 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .