Guided path: Authentication path
Step 4 of 6
Kerberos, NTLM, and authentication packages
How Windows chooses and uses protocol packages to validate identities.
Official Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
Many real-world sign-in and remote access behaviors depend on whether Windows is using Kerberos, NTLM, or another security support provider.
Mental model
Authentication packages are pluggable protocol engines. Windows negotiates or selects the one that matches the identity and environment.
How it works
- 1The LSA and SSPI framework expose a common path for applications and services.
- 2Kerberos is preferred for domain scenarios with ticket-based authentication.
- 3NTLM remains important for compatibility, fallback, and some local or legacy cases.
Key terms
- SSPI
- Security Support Provider Interface, the API layer for Windows integrated authentication.
- Kerberos ticket
- Credential material proving identity and access within a Kerberos realm.
Accessing a domain resource after sign-in
Once domain logon succeeds, Kerberos tickets can be reused so the user does not need to retype credentials for every server access.
Common misconception
Kerberos and NTLM are not interchangeable labels. They imply different flows, caching behavior, and trust assumptions.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
intermediate
Access tokens
SIDs, privileges, impersonation, and the identity payload every process carries.
Next step in your guided path
intermediate
LSASS, SAM, and local security policy
The protected security process and data stores behind local accounts and policy decisions.
Related topic
beginner
Networking
How Windows moves data through the TCP/IP stack, filtering layers, and endpoint APIs.
Related topic
Related topics
Networking
How Windows moves data through the TCP/IP stack, filtering layers, and endpoint APIs.
Access tokens
SIDs, privileges, impersonation, and the identity payload every process carries.
LSASS, SAM, and local security policy
The protected security process and data stores behind local accounts and policy decisions.