Yes, NTLMv1 is old and should be disabled, but...
...NTLMv2 is still widely used. For a large corporation, I assume it would take years to eliminate all software and user activity that uses NTLM in some way.
Microsoft's April 2024 security update blues continue with confirmation of a "significant increase" in NTLM authentication traffic in Windows Server. The issue is caused by installing the update (KB5036909) on domain controllers. NTLM traffic might then suddenly spike. The problem comes hot on the heels of VPN connection …
Why can't they make it that if you want NTLM you have to add it back yourself.
Declare it unfit and clearly lay out the security problems with it and let people continue to use it but you get no support and no basis to complain as you had been duly warned about the dangers of its continued use.
This pussyfooting that "we don't recommend it, and its insecure but will be the provided and made the failover" just seems insane when they themselves say it should not be used. Well you write the stuff so stop inducing.
People are lazy and will use a tool if 8ts already there and seems to be working, so lazy they won't check if it *is* working. They will only move when made to. So make them.
Yeah yeah, "do you know how many systems... Etc." Sure but how many more will it be if they leave it and it keeps getting used and ever more insecure.
And knowing its the failover could lead to peo0le targeting the kerberos end not to exploit it but to make it fail and thus get to using the known insecure backup.
So many Microsoft aspects that we have been using for years now are no longer working or just working badly, basically the company is probably heading for closure at some time in the future.
I'm having to delete Microsoft OneDrive everywhere today because it's no longer reliably functional and all the current Microsoft operating systems don't work as well as their original versions. So many old companies are only busy generating income, not excited users like they did initially..