AES keys are salted. Moreover, if you use public key authentication (e.g. smartcard, FIDO) it's not a requirement that any keys are provisioned on the user. I'm

AES keys are salted. Moreover, if you use public key authentication (e.g. smartcard, FIDO) it's not a requirement that any keys are provisioned on the user. I'm not sure if you can disable the generation of the NTLM key when using passwords, though (and it's true, that is unsalted).