Skip to main contentSummary
Within SCCM’s client push installation properties, there exists a setting to “Allow connection fallback to NTLM.” This setting allows the site server to fallback to NTLM if Kerberos fails (Figure 1).
Adversaries commonly abuse NTLM authentication by coercing computers to authenticate to an attacker-controlled machine then either capturing or relaying the authentication to another resource.
Disabling this setting prevents the use of NTLM authentication and coercion.
NOTE: This technique must be used in conjunction with PREVENT-1.
Linked Defensive IDs
Associated Offensive IDs
References
