Applications that use LM or NTLM?

September 30, 2005 9:14 AM

LM (LanManager) & NTLM (NT Lan Manager) are old, fairly insecure MS protocols for authentication. Are there any other applications besides Win 3.1, NT (pre-sp4), 95, 98 that would require LM or NTLM for authentication?

I am trying to research if any applications require these authentication protocols. I need to disable accepting these on my network, but it's basically impossible to test in our test lab because it doesn't have everything on the live network in there. So I have been trying to research but can't find anything except the MS Operating systems. (So maybe that's my answer.)

posted by aacheson to Computers & Internet (5 answers total)

NTLM authentcation is used sometimes over HTTP to secure websites hosted on IIS. I've seen it used on a few servers, and only noticed it because I tried accessing the sites before support was added to Mozilla and Firefox.
posted by zsazsa at 9:26 AM on September 30, 2005

AFP connections from Mac OS 8, 9 and X to Windows 2000/2003 servers can employ a Microsoft authentication plug-in ("user authentication module", or UAM) that in effect uses NTLM and NTLMv2 authentication methods.
posted by Rothko at 9:58 AM on September 30, 2005

OS/2
posted by cmfletcher at 10:25 AM on September 30, 2005

SQL Server can be configured to use "Windows Authentication", which is NTLM. I believe that Exchange uses NTLM after a fashion as well.
posted by thanotopsis at 11:17 AM on September 30, 2005

Yeah, NTLM can be used by Apache httpd, and also Java app servers and the like (not necessarily built-in, though). We had a mixed 2000/XP client base and NT/2000/2003 server base that used all the old stuff like NTLM.

If you're still supporting legacy stuff (note the NT above), you might have problems, but if you're reasonably modern you'll be fine. Make sure there's not a legacy intranet app in there somewhere that's using it, though-it's really popular for that sort of thing.
posted by RikiTikiTavi at 12:05 AM on October 2, 2005