Problem? NTLMv1 used by override/runas

1

Hi all,

It seems that the Windows agent's feature of override/runas relies on NTLMv1. NTLM is being deprecated, with impacts already in 24H2 and Server 2025.

Further, if a site has deployed Protected Users, those credentials are unable to authenticate via NTLM. (This circumstance led me here.)

With profound thanks to support in CS1468270, I've made these recommendations in the ticket:

  1. Document NTLMv1 as essential to the feature’s function.

  2. If not already in place, PM should plan immediately for modernizing the feature. NTLM is being deprecated in Windows; guidance for replacing it is available.

Features and functionality removed in Windows client | Microsoft Learn
Deprecated features in the Windows client | Microsoft Learn
Resources for deprecated features in the Windows client | Microsoft Learn

"In many cases, applications should be able to replace NTLM with Negotiate using a one-line change in their AcquireCredentialsHandle request to the SSPI."

Tagging: @adinia @ADL @HCLJordan

A thousand thanks to Delannie in helping us find this root cause.

-Andrew

6 Likes
2

Good call! I will echo that it is critical for this to be updated before Microsoft deprecates NTLM. We have items that rely on override. Thanks @atlauren for bringing this to our attention!

4 Likes
3

Hi Andrew, acknowledged and thanks for reporting this. We will plan accordingly.
Thank you

2 Likes