Answers are grounded in this paper and cite their sources.
Technical analysis demonstrates fallback mechanisms from Kerberos to NTLM during unresolved service principal names, highlighting persistent vulnerabilities to relay and pass-the-hash exploits.
An illustrated comparison of NTLM and Kerberos: challenge/response, TGTs and service tickets, the conditions under which Negotiate falls back to NTLM when an SPN cannot be resolved, why relay attacks and Pass-the-Hash work, and the removal of NTLMv1 — all backed by the official documentation. Archived version of https://comcomponent.com/en/blog/ntlm-kerberos-explained/, as published on 2026-08-30. The live article is maintained and may change after this date. First published 2026-07-26.
No takes yet. Share an insight, caveat, or question.
Go Komura (2026) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: