Microsoft Announces Major Windows Security Overhaul Coming Soon

In a significant move towards enhanced security, Microsoft has announced a series of changes aimed at further minimizing dependencies on the legacy authentication protocol, NTLM. Over the past few years, Microsoft has been gradually phasing out NTLM in Windows, favoring Kerberos-based alternatives. This trend will continue with the upcoming versions of client and server editions of Windows, as Microsoft plans to disable NTLM by default.

In an Insider release of Windows 11, certain scenarios that previously necessitated NTLM will be capable of falling back on Initial and Pass-Through Authentication using Kerberos (IAKerb) and Local Key Distribution Center (LocalKDC).

For those unfamiliar, IAKerb allows Kerberos to function even when a client does not have direct access to a domain controller (DC). Traditional Kerberos authentication requires direct connectivity, but IAKerb enables the target service to act as a proxy for the Kerberos-based exchange. This feature is particularly useful in enterprise scenarios where the visibility of DCs is restricted or where client services can reach target services but not relevant DCs.

On the other hand, LocalKDC facilitates Kerberos-based authentication for local account scenarios, thereby eliminating the need for NTLM. This feature proves to be especially beneficial in standalone devices, workgroup environments, and more.

Microsoft is set to dramatically reduce reliance on the aging NTLM protocol across both remote enterprise and local network environments by introducing two new authentication mechanisms: IAKerb and LocalKDC. These modern, secure flows promise consistency and robustness, addressing the growing security concerns that have driven most organizations away from NTLM while still supporting niche legacy use cases.

With the forthcoming Canary Channel update to the Windows Insider Program, Microsoft will unveil these capabilities to early adopters. IAKerb will launch as the default authentication method, whereas LocalKDC will remain disabled by default, giving users the flexibility to switch via Registry tweaks—a process detailed in the official documentation.