--- title: "NTLM Pass-the-Hash Attack: How Hackers Exploit Active Directory" description: "NTLM pass-the-hash attacks let hackers move laterally through Active Directory without cracking a password. Learn how PtH works and how to limit exposure." locale: "en" updated_at: "2026-07-30T11:53:01.964Z" canonical: "https://www.isdecisions.com/en/blog/active-directory/pass-the-hash-attacks-and-active-directory-security-best-practices" --- # Pass-the-Hash attacks explained _NTLM bypass turns Active Directory authentication into the back door for Pass-the-Hash (PtH) attacks. _ **Despite its official deprecation, NTLM remains active in many Active Directory environments, and where NTLM is still running, so is one of the most effective attack techniques in the lateral movement playbook: Pass-the-Hash (PtH). PtH exploits the way NTLM caches password hashes in memory, letting an attacker authenticate as a compromised user without ever cracking their password. ****[Multi-factor authentication (MFA) for Active Directory](/userlock/features/multi-factor-authentication-mfa-active-directory)**** alone can't stop it. But the right access controls can significantly limit how far an attacker gets.** ## NTLM and protocol problems Computing technologies come and go, but the protocols that make possible deeper networking processes such as authentication have a bad habit of hanging around for longer than they should. Sometimes in ways that can end up causing serious problems. A notorious example is [NT LAN Manager (NTLM)](https://learn.microsoft.com/en-us/windows/win32/secauthn/microsoft-ntlm), the original Windows NT authentication protocol whose grave security limitations pushed Microsoft to replace it as the default by the more secure Kerberos as long ago as the year 2000. The problem is that banishing a protocol in Windows Server isn't as simple as just turning on its replacement. A few reasons why: - Older applications that assumed NTLM existed still needed it - NTLM was also popular because it is more forgiving of misconfigurations than Kerberos - Plus, NTLM could be used as a fallback should Kerberos fail for some reason This helps explain why organizations have continued to use NTLM despite its known security weaknesses and its official deprecation by an increasingly anxious Microsoft. But **another reason NTLM has lingered beyond its expected lifespan is that organizations don't always know where they are using it and aren't willing to devote the time and money required to find out.** Today, despite much reduced use, NTLM remains a zombie protocol that can easily be exploited by hackers using an authentication bypass technique called pass-the-hash. ## How NTLM "pass-the-hash" becomes a back door Active Directory pass-the-hash attacks are part of a wider array of authentication bypass techniques, including [Kerberoasting](/blog/active-directory/kerberoasting-in-active-directory) and Kerberos pass-the-ticket (PtT), to name only two. NTLM itself is vulnerable to several techniques, including NTLM interception and relay, but NTLM pass-the-hash is usually the first port of call for hackers. This type of attack is easy to execute and almost guaranteed to move an attack deeper inside Active Directory. **All authentication bypass techniques have one thing in common: hey make lateral movement possible** after an attacker has gained a foothold on the network by compromising a user account. For an attacker, lateral movement is the golden ticket, with authentication bypass offering attackers the most direct path to achieving it. In the case of PtH, the root vulnerability is the way NTLM enables persistence. The ability of a user to stay logged into a resource without having to regularly re-enter a password. When a Windows user authenticates using NTLM, their password is cached in memory on their workstation as a hash value. NTLM subsequently transmits this hash to re-authenticate the user on-the-fly rather than ask for the password. This has obvious problems, starting with the fact that under NTLM the hash is both unsalted (which makes it easier to work out the real password) and, by design, static. With access to a compromised user PC, this means that all the attacker needs to initiate a pass-the-hash authentication bypass attack is to capture and present the hash value. ## Pass-the-hash underlines that NTLM is insecure by design This requires that the attacker first elevate their privileges from an ordinary user level to a local administrator. They commonly do this by exploiting a software vulnerability or poorly configured service path. Once they have the necessary rights, they can grab the hash value from memory using a hacking tool. The [pass-the-hash attack](/glossary/active-directory-security-threats/#credential-theft) on NTLM is beautifully simple. The hacker doesn't need to brute force the hash to uncover the real password like they would have to in Kerberoasting. The attacker can present or "pass" the captured hash inside an NTLM authentication exchange to any application or service the compromised user account can access. From simply hijacking a user's workstation, the attacker is now able to fully impersonate the compromised user inside the network. The attack is impossible to detect without data security or account monitoring, leaving the attacker free to access and copy data without hindrance. This wouldn't be a disaster if it weren't for the fact that **many ordinary Active Directory users often accumulate additional privileges over time. **This gives attackers even more scope for [lateral movement](/blog/mfa/how-to-prevent-lateral-movement-with-mfa) to target additional credentials, and can potentially lead to a full domain compromise down the line. And it's not only user workstations that offer a bridgehead. Admin credentials can inadvertently be exposed should an admin log into a compromised workstation using Remote Desktop. If an attacker already controls the workstation with sufficient privileges to access the Local Security Authority Subsystem Service (LSASS) memory where NTLM hashes or Kerberos tickets are cached, they may be able to harvest these from the admin account to move laterally or escalate privileges within the wider Active Directory environment. ## Can pass-the-hash be stopped? The first defense against PtH is to stop using NTLM, which is usually only still in use because it offers fallback authentication. The more secure Kerberos protocol abandoned NTLM's static challenge-response in favor of timed, encrypted tickets issued using a key distribution system. Put simply, with Kerberos there are no hashes to steal or send. One security layer that doesn't address NTLM vulnerability is MFA. Because NTLM operates at the protocol level, pass-the-hash completely bypasses higher-level MFA challenges. But this doesn't mean that organizations are defenseless in the face of PtH. While MFA on its own doesn't close NTLM PtH vulnerabilities, it does raise the bar by making it harder for attackers to gain an initial foothold on a user account. Solutions such as [UserLock](/userlock/) help make the attack harder and more costly by adding key access controls and monitoring that Active Directory lacks natively: - MFA - Single sign-on (SSO) - Contextual access controls - Real-time monitoring. If attackers manage to gain a foothold, UserLock also helps prevent lateral movement with MFA on UAC prompts, concurrent session limits, and context-based access to control who can log in, from where, on what session type. This could, for example, restrict admins from using Remote Desktop to connect randomly to machines that might be compromised. Similarly, UserLock can also be used to alert when a user account is accessing the network at odd times of the day, or when trying to launch concurrent sessions, which can make it easier to proactively block attacks. ## Backwards compatibility is always a trade-off NTLM's survival shows how legacy authentication systems from decades ago can continue to cause problems for security long after everyone knows that they are no longer secure. An insecure protocol should be replaced but hangs on because it offers the convenience of backwards compatibility. It would be easy to blame Microsoft for not clearly communicating the risks posed by deficient authentication, and perhaps NTLM is an example of this failing. For too long security took second place to a desire not to break things. The bigger lesson is that a veteran authentication system like Active Directory needs modern security. Not just to manage obsolete protocols, but across every aspect of the way authentication is managed. This will be true for as long as organizations continue to use Active Directory, which on current estimates will be decades. This will remain true even when NTLM is fully deprecated. Authentication systems are simply too inviting a target, and defending them has become a continuous exercise in security best practice.