NTLMv2 authentication

NTLMv2 is a challenge-response authentication protocol and a cryptographically strengthened replacement for NTLMv1.

Kerberos

, which is the preferred authentication protocol for

Windows

and

Microsoft Active Directory

domains, is used when a server belongs to a

Windows Server

domain or if a trust relationship with a

Windows Server

domain is established in some other way, such as

Linux

to

Microsoft Active Directory

authentication.

NTLMv2 sends two 16-byte responses to an 8-byte server challenge. The two responses are:

The HMAC-MD5 hash of the server challenge, which is a randomly generated client challenge
An HMAC-MD5 hash of the user's password and other identifying information

The formula that is used begins with the NT Hash, that is stored in the SAM or

Active Directory

, and continues to hash in the username and domain name, using HMAC-MD5.