Book_06 — Eliminating NTLM at the SQL Layer

The Connection Patterns That Generate NTLM, and the Three Phases of the Kerberos/NTLM-Elimination Program Applied to SQL Server

NTLM is a protocol, not a configuration setting — there is no single switch to flip. Identifies every SQL Server connection pattern that generates NTLM traffic (missing SPN, cross-site connections, linked-server passthrough, non-domain-joined application hosts), distinguishes NTLMv1 and NTLMv2 and their different deadlines, and applies the Kerberos/NTLM-elimination program’s Phase A/B/C structure specifically to SQL Server workloads against the program’s 2027-04-01 NTLM backstop.

Note

SQL Server is one of the most common sources of NTLM traffic in a federal environment, and the reasons are more varied than most DBA teams expect. This book traces the Kerberos/NTLM-elimination program’s three phases — assess, block-where-safe, eliminate — as they apply to the SQL Server workload, against the program’s hard 2027-04-01 network-level block.

The three phases of the program’s NTLM elimination, applied to SQL Server.

TipDownload this book

Book_06-bundle.docx — every chapter of this book concatenated into one Word document. Regenerated on every site deploy.

Chapters

Place in the dependency chain: Step 8 — Enforce protocol retirement.

Authoritative references

Checked 19 October 2026.

• Retiring NTLM: frequently asked questions (Microsoft Tech Community)
• Features removed or no longer developed in Windows Server
• Overview of NTLM auditing enhancements in Windows 11, version 24H2, Windows Server 2019, and later versions (Microsoft Support)
• Register a Service Principal Name for Kerberos connections
• sys.dm_exec_connections (Transact-SQL)
• Linked server for SQL Server with Microsoft Entra authentication
• Kerberos constrained delegation overview

TipContinue the series

← Previous: Book 05 — The Login Migration · Index · Next: Book 07 — Access Control →