NTLM Relay in Active Directory: What Pentests Find

An NTLM relay attack inside an Active Directory pentest remains the most reliable critical-severity finding CTDefense reproduces during internal engagements. LLMNR poisoning captures an NTLMv2 hash. The hash is relayed to a web-enrollment endpoint on the certificate authority. A Domain Admin certificate is issued in under a minute. No cracking, no prior credentials, just network adjacency.

Two months from now, Microsoft’s Phase 3 NTLM enforcement lands. Many CISOs are hearing “NTLM is being deprecated” and concluding their environments are protected. They are not. Phase 3 restricts NTLMv1 in single-sign-on contexts. The chain described above runs on NTLMv2 and remains fully functional in every enterprise that has not explicitly disabled LLMNR, enforced SMB signing across all workstations, and remediated its ADCS templates.

This post walks the four-step chain in plain language, calls out the three misconfigurations the team finds most often, clarifies what the October 2026 deadline does and does not cover, and explains what happens when CTDefense reproduces the attack live in front of the executive who commissioned the test.

How LLMNR Poisoning Captures Your Credentials

LLMNR (Link-Local Multicast Name Resolution) and its cousin NBT-NS are legacy Windows name-resolution protocols that ship enabled by default. When a workstation types a hostname it cannot resolve through DNS, the workstation broadcasts an LLMNR query to the local subnet and trusts the first machine that answers.

That is the open door. An attacker with a foothold on the same VLAN, whether a rogue laptop plugged into a meeting-room jack, an infected employee device, or an unmanaged printer sitting where it should not, runs a tool like Responder and answers every broadcast. The victim workstation, believing it has found the file share it was looking for, sends an NTLMv2 authentication attempt to the attacker’s host. The attacker now holds a cryptographic credential the domain trusts, without ever learning the user’s password.

This is MITRE ATT&CK T1557.001, “LLMNR/NBT-NS Poisoning and SMB Relay,” catalogued as an active adversary technique that requires only network adjacency. The LLMNR-poisoning-to-NTLMv2-capture step is a matter of running the tool and waiting; Responder’s default configuration surfaces hashes from Windows machines within minutes on almost every internal network the team tests.

The business translation for a CISO: any user who joins the same broadcast domain as an attacker’s device can be silently coerced into authenticating to that device. No phishing, no macro, no CVE.

From Hash to Domain Admin: The Relay Path

The captured NTLMv2 hash is not immediately useful for lateral movement in the way a cleartext password would be. Cracking it offline is possible but slow and unreliable against strong passwords. Relaying it, meaning forwarding the authentication attempt in real time to a service that will accept it, is the fast path.

Active Directory Certificate Services (ADCS) is the service that turns the hash into Domain Admin. ADCS ESC8 domain escalation targets a specific ADCS deployment pattern: a web-enrollment endpoint that authenticates over HTTP without channel binding, exposed on the internal network. When a relayed NTLMv2 credential from a domain-joined machine, or better still from a Domain Controller machine account coerced through PetitPotam-style tricks, hits that endpoint, the CA happily issues a certificate for that identity. If the requested template allows client authentication, the attacker now holds a signed certificate for a privileged account and can request a Kerberos ticket-granting ticket on that account’s behalf.

The chain, front to back:

• LLMNR broadcast poisoned. Responder answers, the victim workstation authenticates to the attacker.
• NTLMv2 hash captured. The attacker holds a domain-trusted credential.
• Hash relayed to ADCS HTTP endpoint. A relay tool forwards the authentication in real time.
• Domain Admin certificate issued. The CA signs, the attacker requests a TGT on that identity, the domain is compromised.

Time from first poisoned response to Domain Admin, in the majority of engagements: under fifteen minutes.

Three Misconfigs That Keep This Attack Alive

The chain is not a zero-day and it is not clever. It works because three specific hardening steps are still absent from most Windows environments. During internal pentests, CTDefense finds these three consistently:

• LLMNR still enabled on server VLANs. LLMNR ships on by default and is rarely disabled through a GPO. The team finds it active in the majority of Windows environments tested, including on segments that host Domain Controllers and file servers. Disabling it is a single GPO setting (“Turn off multicast name resolution”), which almost no environment has applied enterprise-wide.
• SMB signing not enforced. SMB signing enforcement on Windows workstations blocks the relay half of the chain, and it is the single control that most directly kills this attack. Most deployments enforce signing on Domain Controllers, where it defaults to required, but leave workstations and member servers with signing “enabled but not required,” which relay tools cheerfully accept.
• ADCS templates with default settings. ADCS is deployed for smart-card login, Windows Hello for Business, or code signing, and then left with the default templates active. The default web-enrollment endpoint remains reachable over HTTP, and the “User” and “Machine” templates permit client authentication by any authenticated principal. Nobody looks at ADCS again until it breaks something.

Each of these misconfigurations is remediable in a maintenance window. The problem is not difficulty; the problem is that they are invisible until an internal pentest surfaces them.

What Microsoft’s NTLM Deadline Actually Covers

Microsoft’s phased NTLM deprecation began in 2024 and reaches Phase 3 in October 2026. The announcement copy reads like a solution to the NTLM problem writ large. The actual scope is narrower.

The Microsoft NTLM deprecation NTLMv2 caveat matters: Phase 3 blocks NTLMv1 authentication in interactive single-sign-on contexts. NTLMv1 is the older, weaker version of the protocol, useful mainly for downgrade attacks. NTLMv2, the version used in the relay chain described above, is not restricted. LLMNR poisoning produces NTLMv2 hashes. Relay tools consume NTLMv2 hashes. ADCS ESC8 accepts NTLMv2 authentication. Nothing in the October 2026 change affects any step in that chain.

There is a separate, ongoing effort to move Kerberos-only authentication into the default posture for new Windows deployments. That is real progress. It also does not retire NTLM in existing brownfield environments, where the relay attack lives and thrives.

The safe framing for a board: the October 2026 deadline removes a legacy authentication mode used by very old software. It does not remove the class of attacks that credential-theft studies keep flagging. The 2026 Verizon DBIR, as summarised by SpyCloud, notes that “stolen credentials appear in 39% of all breaches and remain the primary method attackers use to move laterally, escalate privileges, and monetize access after initial entry.” NTLM relay is the cheapest way inside a Windows network to produce that stolen credential.

And the threat class is not theoretical. Check Point Research documented that threat actors “began actively exploiting CVE-2025-24054 just eight days after the patch was released,” targeting government institutions in Poland and Romania with a zero-click NTLM hash-disclosure vulnerability. A follow-on CVE (CVE-2025-50154) then showed the original fix was incomplete. Attackers prioritise NTLM coercion the moment new surface appears.

What the Pentest Engagement Looks Like

Testing this chain is a mandatory element of CTDefense’s Internal Network Penetration Testing scope. On day one, the team runs Responder on a segment representative of a normal user workstation, captures the first NTLMv2 hash, and identifies whether the ADCS surface is exposed. If the chain completes, the engagement schedules a live walk-through: the client’s security lead sits with the tester, watches the Domain Admin certificate get issued, and reads the timeline out loud. Fifteen minutes is not an abstraction when it happens in front of the person who signed the statement of work.

The debrief covers three things:

• The specific GPO changes to disable LLMNR and NBT-NS on the affected VLANs, with a rollback plan if a legacy application depends on them.
• The SMB signing enforcement policy for workstations and member servers, with a phased rollout that avoids breaking legacy SMB1 clients on the network.
• The ADCS template hardening checklist: removing “Client Authentication” from templates that do not need it, requiring manager approval for high-privilege templates, and enforcing HTTPS with channel binding on web enrollment.

Where this fits alongside the broader Active Directory attack surface is worth naming. NTLM relay is one attack path; Kerberoasting, AS-REP roasting, DCSync, unconstrained delegation, and the newer BloodHound path-finding categories are others. An internal pentest that stops at the perimeter, or at generic vulnerability scanning, misses all of them. And once the certificate is issued and the domain is compromised, endpoint tooling is not the layer that will catch the follow-on activity, which is why EDR alone won’t catch credential-relay attacks.

CTDefense continues to support enterprise CISOs in finance, healthcare, government, and manufacturing with internal network pentests that reproduce and demonstrate this chain in the client’s presence. If your environment runs Active Directory and an internal pentest has not touched LLMNR, SMB signing, and ADCS templates in the last twelve months, this is a good week to schedule that conversation.