I was explaining local KDC and iakerb
Then Kerberos
Then NTLM
Then KDC proxy
Then your blog
Then Kerberos
Then NTLM
Then KDC proxy
Then your blog
June 5, 2025 at 7:41 PM
I was explaining local KDC and iakerb
Then Kerberos
Then NTLM
Then KDC proxy
Then your blog
Then Kerberos
Then NTLM
Then KDC proxy
Then your blog
Anyway, y'all wanna see a demo?
October 11, 2023 at 6:00 PM
Anyway, y'all wanna see a demo?
About NTLM deprecation, there's nothing new that hadn't been announced previously. I don't know if it'll be discussed in another presentation as it's unclear when and how we'll see the IAKerb and local KDC extensions released
April 29, 2025 at 5:51 PM
About NTLM deprecation, there's nothing new that hadn't been announced previously. I don't know if it'll be discussed in another presentation as it's unclear when and how we'll see the IAKerb and local KDC extensions released
I look forward to seeing you all at #MC2MCConnect on Thursday, February 6th! Learn about IAKERB and LocalKDC! #Community #Windows #Server #Azure #MVPBuzz #VeeamVanguard
February 3, 2025 at 9:15 AM
I look forward to seeing you all at #MC2MCConnect on Thursday, February 6th! Learn about IAKERB and LocalKDC! #Community #Windows #Server #Azure #MVPBuzz #VeeamVanguard
✨ IAKerb e LocalKDC su Windows: meno dipendenza da NTLM, più Kerberos
Leggi il blog: spcnet.it/iakerb-e-loc...
Leggi il blog: spcnet.it/iakerb-e-loc...
June 13, 2026 at 9:33 AM
✨ IAKerb e LocalKDC su Windows: meno dipendenza da NTLM, più Kerberos
Leggi il blog: spcnet.it/iakerb-e-loc...
Leggi il blog: spcnet.it/iakerb-e-loc...
Spent a year and a half rewriting a good chunk of the Kerberos crypto stack to make it agile enough to kill RC4. Rewrote a huge chunk of the Kerberos client code to make it support IAKERB, plus converted every Windows machine into its own mini-DC, all while leading the NTLMless v-team.
July 29, 2024 at 10:00 PM
Spent a year and a half rewriting a good chunk of the Kerberos crypto stack to make it agile enough to kill RC4. Rewrote a huge chunk of the Kerberos client code to make it support IAKERB, plus converted every Windows machine into its own mini-DC, all while leading the NTLMless v-team.
Buuut we have this thing called IAKERB which flows through the application protocol's transport instead and it sends AS-REQs and TGS-REQs that the KDC needs so what if we did IAKERB to that machine and then the Local KDC answers those messages instead of sending it off to an enterprise KDC??
Homer Simpson's S-M-R-T Moment on Fire
ALT: Homer Simpson's S-M-R-T Moment on Fire
static.klipy.com
June 30, 2026 at 5:36 PM
Buuut we have this thing called IAKERB which flows through the application protocol's transport instead and it sends AS-REQs and TGS-REQs that the KDC needs so what if we did IAKERB to that machine and then the Local KDC answers those messages instead of sending it off to an enterprise KDC??
#MSXFAQ LocalKdc und IAKerb www.msxfaq.de/windows/kerb... - Noch funktioniert IAKerb und LocalKdc nicht aber wenn es denn mal geht, dann kommen wir der NTLM-Abschaltung einen großen Schritt näher. Auch für Computer ohne AD und Clients ohne Verbindung zum KDC.
February 22, 2026 at 11:16 PM
#MSXFAQ LocalKdc und IAKerb www.msxfaq.de/windows/kerb... - Noch funktioniert IAKerb und LocalKdc nicht aber wenn es denn mal geht, dann kommen wir der NTLM-Abschaltung einen großen Schritt näher. Auch für Computer ohne AD und Clients ohne Verbindung zum KDC.
Mmm. A few things, actually.
NTLM doesn't require the client have line of sight to a 3rd party authentication server. It just talks to the target server and then makes auth the server's problem instead.
We build IAKERB to solve that. It's deceptively simple.
NTLM doesn't require the client have line of sight to a 3rd party authentication server. It just talks to the target server and then makes auth the server's problem instead.
We build IAKERB to solve that. It's deceptively simple.
June 30, 2026 at 5:36 PM
Mmm. A few things, actually.
NTLM doesn't require the client have line of sight to a 3rd party authentication server. It just talks to the target server and then makes auth the server's problem instead.
We build IAKERB to solve that. It's deceptively simple.
NTLM doesn't require the client have line of sight to a 3rd party authentication server. It just talks to the target server and then makes auth the server's problem instead.
We build IAKERB to solve that. It's deceptively simple.
IAKERB solves that problem for us by taking all those messages that need to go to the KDC by proxying all those messages over the same channel that talks to the server and then the server forwards it to the KDC.
It's deceptively simple in principle.
Implementation is...oy. But we did it!
It's deceptively simple in principle.
Implementation is...oy. But we did it!
June 30, 2026 at 5:36 PM
IAKERB solves that problem for us by taking all those messages that need to go to the KDC by proxying all those messages over the same channel that talks to the server and then the server forwards it to the KDC.
It's deceptively simple in principle.
Implementation is...oy. But we did it!
It's deceptively simple in principle.
Implementation is...oy. But we did it!
Microsoft schränkt NTLM in Windows weiter ein. Ab Juni lösen IAKerb und LocalKDC das alte Authentifizierungsverfahren ab. #Microsoft #Windows
Windows-Sicherheit: Microsoft schränkt NTLM-Nutzung stark ein
winfuture.de
June 3, 2026 at 7:17 PM
Microsoft schränkt NTLM in Windows weiter ein. Ab Juni lösen IAKerb und LocalKDC das alte Authentifizierungsverfahren ab. #Microsoft #Windows
Finally, updated LocalKDC and IAKerb demo. It is the same demo we had for FOSDEM talk but updated to use unqualified username for the final test against a remote system.
[Video] Original post on mastodon.social
mastodon.social
March 13, 2025 at 2:40 PM
Finally, updated LocalKDC and IAKerb demo. It is the same demo we had for FOSDEM talk but updated to use unqualified username for the final test against a remote system.
We keep slipping on IAKerb releases due to a stack of interop issues and both the devs and bugs don't respond well to yelling at them, but the light at the end of the tunnel is visible at least. Fingers crossed.
November 2, 2025 at 4:48 PM
We keep slipping on IAKerb releases due to a stack of interop issues and both the devs and bugs don't respond well to yelling at them, but the light at the end of the tunnel is visible at least. Fingers crossed.
I have the privilege of presenting at #ExpertsLiveNetherlands 2025 on CISO's delight: SMB over QUIC meets IAKERB & LocalKDC in Windows Server 2025 ==> www.expertslive.nl/sessies25 Join me and find out all the capabilities this brings for modern filesharing #MVPBuzz #SMBoverQUIC
Sessies 2025 | Experts Live Netherlands
www.expertslive.nl
May 3, 2025 at 3:15 PM
I have the privilege of presenting at #ExpertsLiveNetherlands 2025 on CISO's delight: SMB over QUIC meets IAKERB & LocalKDC in Windows Server 2025 ==> www.expertslive.nl/sessies25 Join me and find out all the capabilities this brings for modern filesharing #MVPBuzz #SMBoverQUIC
Time-wise if you need NTLM gone now without exception, then KDC Proxy is a good option. Even if IAKerb went full prod today, it's not going to downlevel versions (south of 24h2/2025) any time soon, so so you'd either need to update every machine or go the proxy route.
November 2, 2025 at 4:26 PM
Time-wise if you need NTLM gone now without exception, then KDC Proxy is a good option. Even if IAKerb went full prod today, it's not going to downlevel versions (south of 24h2/2025) any time soon, so so you'd either need to update every machine or go the proxy route.
I don't have specific guidance for RDS unfortunately. IAKerb will eventually replace KDC Proxy for most scenarios including this (not all, but the rest are niche). I do know the HTML5 client thing genuinely just doesn't support kerberos at all yet. It's on their TODO list.
November 2, 2025 at 4:23 PM
I don't have specific guidance for RDS unfortunately. IAKerb will eventually replace KDC Proxy for most scenarios including this (not all, but the rest are niche). I do know the HTML5 client thing genuinely just doesn't support kerberos at all yet. It's on their TODO list.
At this point it would help to have a basic interop with MIT code because there is simply no released Windows version with new iakerb implementation so we cannot release MIT krb5 version either. MS-KILE and other specs aren't updated either so discovery semantics aren't documented as well.
March 2, 2025 at 4:10 PM
At this point it would help to have a basic interop with MIT code because there is simply no released Windows version with new iakerb implementation so we cannot release MIT krb5 version either. MS-KILE and other specs aren't updated either so discovery semantics aren't documented as well.
Yep. But the client needs to know a realm in AS-REQ and it cannot, in a general case without local heuristics. So I guess we stuck with an empty realm first in iakerb and a retry to fix up the realm. Again, this is a guess so far and we are waiting for ability to actually test and agree for smth.
March 2, 2025 at 4:37 PM
Yep. But the client needs to know a realm in AS-REQ and it cannot, in a general case without local heuristics. So I guess we stuck with an empty realm first in iakerb and a retry to fix up the realm. Again, this is a guess so far and we are waiting for ability to actually test and agree for smth.
Grootste Patch Tuesday ooit (bijna 1000 CVE's), een Defender-exploit die binnen dagen alweer omzeild wordt, en developer-pc's voor lokale AI. Plus: ChatGPT's klembord lekte je Gmail. Aflevering 35 van de IT Bro's Podcast:
S06A35 - Duizend CVE's, één Patch Tuesday, nul rust - IT Bro's
Raymond en Sander bespreken de grootste Microsoft Patch Tuesday ooit (bijna 1000 CVE’s), een Defender-exploit die binnen dagen alweer omzeild wordt, en developer-pc’s voor lokale AI. Plus: ChatGPT’s klembord lekte je Gmail. Nieuws Windows Insiders zetten IAKerb standaard aan en introduceren Cloud Rebuild. Microsoft kondigt Project Zenith aan: kant-en-klare developer-pc’s voor lokale AI-modellen. Battery Flyout wordt volledig native WinUI 3. 80%+ van smartphones voldoet nog niet aan de EU-reparatie-eisen. Apple’s septemberkeynote: AirPods 5, Watch Series 12, iPhone 18 Pro en prijsverhogingen. AI-stuk Microsoft’s publiceerde hun AI Transparency Report. OpenAI’s lanceerde GPT-6 Astra met omstreden “recurrent depth”-redenering. Google’s Gemini 3.8 Flash...
itbros.nl
September 11, 2026 at 10:04 AM
Grootste Patch Tuesday ooit (bijna 1000 CVE's), een Defender-exploit die binnen dagen alweer omzeild wordt, en developer-pc's voor lokale AI. Plus: ChatGPT's klembord lekte je Gmail. Aflevering 35 van de IT Bro's Podcast:
Bir sabah NTLM’i GPO’dan kapat
#ActiveDirectory #Kerberos #WindowsServer #Guvenlik
https://mustafaerbay.com.tr/blog/technology/ntlm-kapaniyor-once-fallbackin-nedenini-bulun/
#ActiveDirectory #Kerberos #WindowsServer #Guvenlik
https://mustafaerbay.com.tr/blog/technology/ntlm-kapaniyor-once-fallbackin-nedenini-bulun/
NTLM Kapanıyor: Önce Fallback'in Nedenini Bulun
Microsoft NTLM'i üç fazda varsayılan-kapalı yapıyor. Kapatma GPO'sundan önce 4020 olaylarındaki neden kodları, NTLMv1'in Ekim 2026 eşiği, IAKerb ve LocalKDC'nin neyi çözüp neyi çözmediği.
mustafaerbay.com.tr
September 11, 2026 at 7:06 AM
Bir sabah NTLM’i GPO’dan kapat
#ActiveDirectory #Kerberos #WindowsServer #Guvenlik
https://mustafaerbay.com.tr/blog/technology/ntlm-kapaniyor-once-fallbackin-nedenini-bulun/
#ActiveDirectory #Kerberos #WindowsServer #Guvenlik
https://mustafaerbay.com.tr/blog/technology/ntlm-kapaniyor-once-fallbackin-nedenini-bulun/
Microsoft is finally pulling the plug on NTLM.
#ActiveDirectory #Kerberos #WindowsServer #Security
https://mustafaerbay.com.tr/en/blog/technology/ntlm-kapaniyor-once-fallbackin-nedenini-bulun/
#ActiveDirectory #Kerberos #WindowsServer #Security
https://mustafaerbay.com.tr/en/blog/technology/ntlm-kapaniyor-once-fallbackin-nedenini-bulun/
NTLM Is Being Switched Off: Find the Fallback Reason First
Microsoft is turning NTLM off by default in three phases. Before the blocking GPO: the reason codes in event 4020, NTLMv1's October 2026 threshold, and what IAKerb and LocalKDC do and don't solve.
mustafaerbay.com.tr
September 11, 2026 at 7:06 AM
Microsoft is finally pulling the plug on NTLM.
#ActiveDirectory #Kerberos #WindowsServer #Security
https://mustafaerbay.com.tr/en/blog/technology/ntlm-kapaniyor-once-fallbackin-nedenini-bulun/
#ActiveDirectory #Kerberos #WindowsServer #Security
https://mustafaerbay.com.tr/en/blog/technology/ntlm-kapaniyor-once-fallbackin-nedenini-bulun/
Microsoft just released Windows 11 Insider Preview build 29661.1000 for Experimental (Future Platforms) Channel. See what's new: #Windows11InsiderPreview
Windows 11 Future Platforms build 29661 enables IAKerb by default
Microsoft just released Windows 11 Insider Preview build 29661.1000 for Experimental (Future Platforms) Channel. See what's new:
www.neowin.net
September 8, 2026 at 5:37 PM
Microsoft just released Windows 11 Insider Preview build 29661.1000 for Experimental (Future Platforms) Channel. See what's new: #Windows11InsiderPreview
CISA KEV: patch 2 exploited Windows priv-esc flaws. DHCP CVE-2026-62714/62720: Server 2012–2025. Win11 29661.1000 defaults IAKerb on. Outlook Mobile gets on-prem Exchange AD FS auth. Member reports KB5120998 trouble. +6 more stories, 2 replies, 28 members
CISA KEV Adds Two Exploited Windows Privilege Escalation Flaws
CISA has added two actively exploited Windows privilege-escalation flaws, a critical Adobe Commerce and Magento remote-code-execution bug, and an N-able N-central server vulnerability to its Known…
windowsforum.com
September 9, 2026 at 12:00 AM
CISA KEV: patch 2 exploited Windows priv-esc flaws. DHCP CVE-2026-62714/62720: Server 2012–2025. Win11 29661.1000 defaults IAKerb on. Outlook Mobile gets on-prem Exchange AD FS auth. Member reports KB5120998 trouble. +6 more stories, 2 replies, 28 members