Now sometimes Kerberos is either not applicable or does not apply or may be unavailable for whatever
reason. And instead of cutting services off to the users to access those resources, there is a backup
in Active Directory and it's something very familiar to us and that is NTLM or New Technology
LAN Manager. And it follows a little bit of a process on its own that I will have the steps
below this video. And step one is negotiation. Clients going to connect usually a user through
a username and password and request a specific resource. Now it's like going to a file server
directly through start run and hitting WACWAC 192 etc etc. And instead of having Kerberos the
response from the user to that resource will be hey I can't use Kerberos but I can use NTLM
version 2. And version 2 is what we use for modern day Windows. You may see version 1 in
operating systems like XP. Now the service we requested is going to issue a challenge in return
that's going to generate a random number called a not not n-o-n-c-e. And it's going to be the
challenge and it's going to be sent to the actual client in return. And the server is basically
going to say encrypt this specific number enter number here 1 2 3 4 5 or whatever it is
with your password hash it and send it back. Almost but not it's not a salt but it kind of
works like one in a way right. And then you're going to get a response back where the client
takes the notes and then encrypts it using their password hash by combining the two and then sends
the result over to the actual server in with that response. And if the two match up then we move on
to step four for verification. Now the server is going to take that response right and send it to
the domain controller the verification response that the resource actually got. And then the
domain controller is going to check if the math behind all this is correct and if it matches
boom one of the twin powers activate in form of water bucket. Now the biggest thing that I want
to point out here is that NTLM version 2 specifically version 2 is used as a backup.
And that's because Kerberos may be down whatever the case may be or my favorite it's whenever
somebody requests a resource by using the actual IP address instead of the fully qualified domain
name. And this could happen as we mentioned earlier with the whack whack where they do
192.168 whatever whatever. But if they were to use the fully qualified domain name for example
in our lab environment let's say we have a share on clientvm client-vm.texas.local
slash share. And that would invoke the Kerberos because that FQDN especially the texas.local at
the end of the computer name not only matches inside the DNS because you know our domain
controller is the DNS server. It also means that it's inside of Active Directory and uses
that authentication method preferred which is Kerberos. But if we go and try to let's say on a
POSIX based system and go in and use the mount command and use only the IP addressing it's going
to use NTLM as a as a primary method instead of the backup because it doesn't know that it's tied
to a domain. It being the actual workstation that we're on that POSIX based system. So I just want
to point that out that that's something to keep in mind too when you're monitoring network traffic
that if you're seeing NTLM request in an active domain environment that's definitely going to
highlight some areas of either misconfiguration or users specifically manually typing things in
and something you might want to pay attention to.