The first NTLM version. It no longer ships with Windows 11 24H2 or Windows Server 2025, Credential Guard blocks it, and the version a logon relied on is recorded in event 4624.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains NTLMv1 in context, with comparison tables and the common traps.
Terms in this definition
- FIRST
A DAX function available only inside visual calculations. It fetches the value at the start of one axis of the visual's matrix, which makes it handy for comparing each point with the first; its opposite is LAST.
- NTLM
NT LAN Manager, an older Windows challenge-response protocol available through Microsoft Entra Domain Services. Mounting Azure Files over SMB with a key relies on NTLMv2, so permitting Kerberos alone breaks such mounts.
- Credential Guard
Uses virtualisation-based security to isolate Kerberos TGTs and NTLM hashes. Windows Server 2025 enables it automatically on domain-joined member servers (not DCs), which breaks live migration relying on CredSSP.
- Event
Table in Log Analytics where entries from Windows event logs are kept.
Related terms
- Insecure Protocols workbook
A workbook in Microsoft Sentinel that detects the use of weak protocols, for example SMBv1, NTLMv1, SSL/TLSv1 and unsigned LDAP binds.
- LM
An old password hashing and sign-in protocol. LANMAN has been deprecated, and Windows Server 2025 dropped NTLMv1 altogether.