I'm late to this party so this comment will be buried, but I hope it's useful to someone. MSFT will be replacing some of the NTLM functionality with something

I'm late to this party so this comment will be buried, but I hope it's useful to someone. MSFT will be replacing some of the NTLM functionality with something called IAKERB, which is a GSS-API mechanism (aka, an SSP in Windows terminology) that allows the server application to proxy Kerberos messages between the client and the Kerberos key distribution centers (KDCs), and this will replace two things that NTLM provides: - support for cases where there is no direct line of sight between the client and the KDCs - support for using username & password local to the server by having the server have its own local KDC The only NTLM feature not provided by the new thing is the ability to InitializeSecurityContext() without naming the target service. This is why it's not entirely a drop-in replacement, and NTLM-using applications do need remediation for this (and, along the way, to replace uses of the NTLM SSP with the Negotiate SSP). Because the apps always know a name for the target, there is no reason that this remediation should be hard. Therefore you can consider all the NTLM functionality replaced by IAKERB. EDIT: I don't mind downvotes, but if I'm trying to provide useful technical information and you disagree with it it, it might be useful to say so because a) I might be wrong, b) you might be wrong, c) others might learn something.