Skip to content

Glossary: Hardening, Firewalls and Intrusion Detection

NTLM

An older Microsoft login (authentication) protocol, still checked by Windows domain controllers. An NTLM check for a canary account appears as event 4776.

Where the book teaches it

Related terms

KerberosDomain controllerEvent ID