Direct Inward Dialing: +1 408 916 9892
Kerberos is a network authentication protocol which uses symmetric key cryptography to provide authentication services to client-server applications. It is a ticket based protocol, and requires a trusted third party known as the key distribution center (KDC) to operate. Initially developed by Massachusetts Institute of Technology (MIT) for Project Athena, Kerberos is now used as the default authentication protocol in Windows 2000, and all the later versions.
New Technology LAN Manager (NTLM) is a suite of Microsoft authentication protocols designed to provide authentication, integrity, and confidentiality for user logons to local machines and other workgroup computers. It is an encrypted challenge - response protocol used to authenticate users without relaying their password. NTLM was the preferred authentication protocol in Windows versions earlier to Windows 2000; it was then replaced by Kerberos. Microsoft still supports NTLM to provide backward compatibility.
The following are some of the differences between the two authentication protocols.
Kerberos is a ticket based authentication protocol. The principal entities involved in Kerberos protocol are:
From a security standpoint, Kerberos is considered more secure compared to NTLM. NTLM requires a point-to-point connection between the web browser and server in order to function properly while Kerberos's usage of tickets to prove users' identity without transmitting the password over the network makes it more secure. It also doesn't cache passwords on the local user's hard disk. Additionally, Kerberos supports smart card logon security feature which relies on two-factor authentication and provides stronger authentication compared to password logon.
Kerberos supports both impersonation and delegation while delegation support is not provided by NTLM. Impersonation is the ability of a server application to take on the identity of the client. When the server accepts a client connection, it impersonates the client so that access checks are performed using the client's credentials. Delegation is also known as authentication forwarding. Delegation enables a service to access remote resources on behalf of a client. For example, user A can give rights to an intermediary machine B to authenticate an application server C as if machine B was user A. This means that application server C will base its authorization decisions on user A's identity rather than on machine B's account.
One of the key features of Kerberos protocol is that it allows mutual authentication, ie: authenticity of both client and server are verified. The NTLM challenge-response mechanism only provides client authentication, which means the clients might provide their credentials to a bogus server.
ADAudit Plus is a comprehensive Active Directory auditing solution that will help you monitor, and audit local logon and logoffs by domain users. It can also track other critical events that can lead to network disruptions.
ADAudit Plus simplifies Kerberos and NTLM authentication activity tracking with predefined Logon Activity report along with intuitive graphical representation of the same for the ease of comprehension. It also provides you the option to generate custom reports and export them in your preferred format (PDF, XLS, HTML, and CSV)
Once ADAudit Plus has been installed, it can automatically configure audit policies required for Active Directory auditing. To enable automatic configuration: Log in to the ADAudit Plus web console → Domain Settings → Audit Policy: Configure.
You can use this report to ascertain if secure authentication protocols like Kerberos or NTLMv2 are being used. In case there are users in the organization who use outdated authentication protocols such as NTLMv1 or LAN Manager, that information will be displayed. You can then take the necessary steps to correct this.
ADAudit Plus comes bundled with more than 200 predefined reports that make AD auditing easier. The solution also sends real-time alerts for critical events and helps you to secure your network from threats, and boosts your IT security posture. Check out the capabilities of ADAudit Plus here.
Try ADAudit Plus login monitoring tool to audit, track, and respond to malicious login and logoff actions instantaneously.
Try ADAudit Plus for free
Free Edition
