NTLM Negotiate: Active Directory Sign-In

Why It Matters

Every NTLM exchange starts here, including those a poisoned name or a forced callback starts with the wrong machine. Knowing why Windows fell back to NTLM is the first step to removing it.

Where It Sits

The strip shows every step of the NTLM sign-in, with this page's step marked. Each of the others links to its own page, and Step Through It opens the walk-through on the topic page.

NTLMStep Through It

Step 1 of 6, Negotiate, ws-017 to srv-fin-01
Step 2 of 6, Challenge, srv-fin-01 to ws-017
Step 3 of 6, Authenticate, ws-017 to srv-fin-01
Step 4 of 6, Pass-Through, srv-fin-01 to dc-01
Step 5 of 6, DC Answer, dc-01 to srv-fin-01
Step 6 of 6, Access, srv-fin-01 to ws-017

What Happens

Windows prefers Kerberos and falls back to NTLM when Kerberos cannot work, such as when the server is named by its IP address, the account is local, no domain controller can be reached, or an application calls NTLM directly. When dana opens \\192.0.2.15\finance by its address, the first case applies, so ws-017 starts NTLM inside the SMB session setup.

The NEGOTIATE_MESSAGE carries a signature, its message type and the NEGOTIATE flags, which list the options ws-017 supports, such as signing, sealing, extended session security and 128-bit keys. It can also name the client's domain and workstation, but only when its flags say they are there. The user's own name comes only in the third message.

No password, hash or answer travels in it, so there is nothing here to steal. The risk lies in where it goes. A client tricked into opening NTLM with the wrong machine, or a server made to start NTLM towards one, carries on to the challenge and the answer.

Nothing is logged for this message on its own. Enhanced NTLM auditing runs on Windows 11 24H2 and Windows Server 2025, and on Windows Server 2019 and 2022 with updates from 13 October 2026. Where it runs, the client later records each outgoing NTLM sign-in in its Microsoft-Windows-NTLM/Operational log as event 4020, or 4021 when the exchange was weaker, with the reason NTLM was used.

Those reasons show what to move to Kerberos before outgoing NTLM is refused. Once it is refused, a poisoned or forced connection gets no NTLM answer at all.

What Is Sent

Each part of the message is listed with what it holds and what protects it. A part sealed with a key can be read only by whoever holds that key, and a part marked In the clear has no protection of its own.

Part	What It Holds	Protection and Who Can Read It
Options `NegotiateFlags`	What ws-017 supports, such as signing, sealing, extended session security and 128-bit keys.	In the clearAnyone who sees the traffic can read it.
Domain and workstation `DomainName, WorkstationName`	Optional. It may name ws-017's domain and machine, but dana's own name comes only in the third message.	In the clearAnyone who sees the traffic can read it.

Reason ID in Events 4020 and 4021

Enhanced NTLM auditing records why each outgoing NTLM sign-in did not use Kerberos, as a Reason ID in events 4020 and 4021 in the client's Microsoft-Windows-NTLM/Operational log. Each reason points at its fix, such as naming a server by its name instead of its address.

Reason ID	Why NTLM Was Used Instead of Kerberos
0	Unknown reason
1	The application called NTLM directly
2	A local account was signing in
4	A cloud account was signing in
5	The target name was missing or empty
6	Kerberos or other protocols could not resolve the target name
7	The target name contains an IP address
8	The target name is duplicated in Active Directory
9	No domain controller could be reached
10	NTLM was called over a loopback interface
11	NTLM was called with a null session

What Is Logged

Nothing is logged for this message on its own, and no secret has been sent yet. Where enhanced NTLM logging runs, the client later records the sign-in as event 4020 in its Microsoft-Windows-NTLM/Operational log.

Attacks That Hook in Here

These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.

LLMNR, NBT-NS and mDNS Poisoning
Answers the local network's name queries so victims sign in to the wrong machine.
At This Step After a fake answer to its name query, the victim sends this opening to the wrong machine, starting a sign-in that machine can capture.
Forced Authentication (Coercion)
Makes a server, a DC included, sign in to a machine the attacker controls.
At This Step A forced callback makes a server, often a DC, send this opening to a host the attacker named, signing in as its own computer account.
NTLM Relay
Passes a victim's NTLM sign-in to another server and keeps the session it opens.
At This Step A machine in the middle passes this opening on to the server it wants to reach, so the victim's sign-in carries on there.