To my knowledge the current best practicen is to have all NTLM versions disabled and use Kerberos which surprise surprise is also the backbone of linux enterpri

To my knowledge the current best practicen is to have all NTLM versions disabled and use Kerberos which surprise surprise is also the backbone of linux enterprise login... AD is just a fancy interface to LDAP with Kerberos, that sound familiar in any way?