NT LAN Manager

Suite of Microsoft security protocols for authentication, integrity, and confidentiality

In a Windows network, NT (New Technology) LAN Manager (NTLM) is a suite of Microsoft security protocols intended to provide authentication, integrity, and confidentiality to users.[1][2][3] NTLM is the successor to the authentication protocol in Microsoft LAN Manager (LANMAN), an older Microsoft product. The NTLM protocol suite is implemented in a Security Support Provider, which combines the LAN Manager authentication protocol, NTLMv1, NTLMv2 and NTLM2 Session protocols in a single package. Whether these protocols are used or can be used on a system which is governed by Group Policy settings, for which different versions of Windows have different default settings.

NTLM passwords are considered weak because they can be brute-forced very easily with modern hardware.[4]

## Contents

* 1 Protocol
* 1.1 NTLMv1
* 1.2 NTLMv2
* 1.3 NTLM2 Session
* 2 Availability and use of NTLM
* 2.1 Use of the NTLM Security Support Provider
* 2.2 Use of protocol versions
* 3 Weakness and vulnerabilities
* 4 Compatibility with Linux
* 5 See also
* 6 References
* 7 External links

## Protocol[edit]

NTLM is a challenge–response authentication protocol which uses three messages to authenticate a client in a connection-oriented environment (connectionless is similar), and a fourth additional message if integrity is desired.[5][6][7][8]

1. First, the client establishes a network path to the server and sends a NEGOTIATE_MESSAGE advertising its capabilities.[9]
2. Next, the server responds with CHALLENGE_MESSAGE which is used to establish the identity of the client.[10]
3. Finally, the client responds to the challenge with an AUTHENTICATE_MESSAGE.[11]

The NTLM protocol uses one or both of two hashed password values, both of which are also stored on the server (or domain controller), and which through a lack of salting are password equivalent, meaning that if you grab the hash value from the server, you can authenticate without knowing the actual password. The two are the LM hash (a DES-based function applied to the first 14 characters of the password converted to the traditional 8-bit PC charset for the language), and the NT hash (MD4 of the little endian UTF-16 Unicode password). Both hash values are 16 bytes (128 bits) each.[12]

The NTLM protocol also uses one of two one-way functions, depending on the NTLM version; NT LanMan and NTLM version 1 use the DES-based LanMan one-way function (LMOWF), while NTLMv2 uses the NT MD4 based one-way function (NTOWF).[12][13]

[2]

### NTLMv1[edit]

The server authenticates the client by sending an 8-byte random number, the challenge. The client performs an operation involving the challenge and a secret shared between client and server, specifically one of the two password hashes described above. The client returns the 24-byte result of the computation. In fact, in NTLMv1 the computations are usually made using both hashes and both 24-byte results are sent. The server verifies that the client has computed the correct result, and from this infers possession of the secret, and hence the authenticity of the client.

Both the hashes produce 16-byte quantities. Five bytes of zeros are appended to obtain 21 bytes. The 21 bytes are separated in three 7-byte (56-bit) quantities. Each of these 56-bit quantities is used as a key to DES encrypt the 64-bit challenge. The three encryptions of the challenge are reunited to form the 24-byte response. Both the response using the LM hash and the NT hash are returned as the response, but this is configurable.

C = 8-byte server challenge, random
K1 | K2 | K3 = NTLM-Hash | 5-bytes-0
response = DES(K1,C) | DES(K2,C) | DES(K3,C)

### NTLMv2[edit]

NTLMv2, introduced in Windows NT 4.0 SP4[14] (and natively supported in Windows 2000), is a challenge-response authentication protocol. It is intended as a cryptographically strengthened replacement for NTLMv1, enhancing NTLM security by hardening the protocol against many spoofing attacks and adding the ability for a server to authenticate to the client.[1][15][16]

NTLMv2 sends two responses to an 8-byte server challenge. Each response contains a 16-byte HMAC-MD5 hash of the server challenge, a fully/partially randomly generated client challenge, and an HMAC-MD5 hash of the user's password and other identifying information. The two responses differ in the format of the client challenge. The shorter response uses an 8-byte random value for this challenge. In order to verify the response, the server must receive as part of the response the client challenge. For this shorter response, the 8-byte client challenge appended to the 16-byte response makes a 24-byte package which is consistent with the 24-byte response format of the previous NTLMv1 protocol. In certain non-official documentation (e.g. DCE/RPC Over SMB, Leighton) this response is termed LMv2.

The second response sent by NTLMv2 uses a variable-length client challenge which includes (1) the current time in NT Time format, (2) an 8-byte random value (CC2 in the box below), (3) the domain name and (4) some standard format stuff. The response must include a copy of this client challenge, and is therefore variable length. In non-official documentation, this response is termed NTv2.

Both LMv2 and NTv2 hash the client and server challenge with the NT hash of the user's password and other identifying information. The exact formula is to begin with the NT hash, which is stored in the SAM or AD, and continue to hash in, using HMAC-MD5, the username and domain name. In the box below, X stands for the fixed contents of a formatting field.

SC = 8-byte server challenge, random
CC = 8-byte client challenge, random
CC* = (X, time, CC2, domain name)
v2-Hash = HMAC-MD5(NT-Hash, user name, domain name)
LMv2 = HMAC-MD5(v2-Hash, SC, CC)
NTv2 = HMAC-MD5(v2-Hash, SC, CC*)
response = LMv2 | CC | NTv2 | CC*

### NTLM2 Session[edit]

The NTLM2 Session protocol is similar to MS-CHAPv2.[17] It consists of authentication from NTLMv1 combined with session security from NTLMv2.

Briefly, the NTLMv1 algorithm is applied, except that an 8-byte client challenge is appended to the 8-byte server challenge and MD5-hashed. The least 8-byte half of the hash result is the challenge utilized in the NTLMv1 protocol. The client challenge is returned in one 24-byte slot of the response message, the 24-byte calculated response is returned in the other slot.

This is a strengthened form of NTLMv1 which maintains the ability to use existing Domain Controller infrastructure yet avoids a dictionary attack by a rogue server. For a fixed X, the server computes a table where location Y has value K such that Y=DES_K(X). Without the client participating in the choice of challenge, the server can send X, look up response Y in the table and get K. This attack can be made practical by using rainbow tables.[18]

However, existing NTLMv1 infrastructure allows that the challenge/response pair is not verified by the server, but sent to a Domain Controller for verification. Using NTLM2 Session, this infrastructure continues to work if the server substitutes for the challenge the hash of the server and client challenges.

NTLMv1
Client<-Server:  SC
Client->Server:  H(P,SC)
Server->DomCntl: H(P,SC), SC
Server<-DomCntl: yes or no

NTLM2 Session
Client<-Server:  SC
Client->Server:  H(P,H'(SC,CC)), CC
Server->DomCntl: H(P,H'(SC,CC)), H'(SC,CC)
Server<-DomCntl: yes or no

## Availability and use of NTLM[edit]

Since 2010, Microsoft no longer recommends NTLM in applications:[19]

> Implementers should be aware that NTLM does not support any recent cryptographic methods, such as AES or SHA-256. It uses cyclic redundancy checks (CRC) or MD5 for integrity, and RC4 for encryption.

> Deriving a key from a password is as specified in RFC1320 and FIPS46-2. Therefore, applications are generally advised not to use NTLM.

Despite these recommendations, NTLM is still widely deployed on systems.[citation needed] A major reason is to maintain compatibility with older systems. However, it can be avoided in some circumstances.[how?]

Microsoft has added the NTLM hash to its implementation of the Kerberos protocol to improve interoperability (in particular, the RC4-HMAC encryption type). According to an independent researcher, this design decision allows Domain Controllers to be tricked into issuing an attacker with a Kerberos ticket if the NTLM hash is known.[20] Microsoft adopted Kerberos as the preferred authentication protocol for Windows 2000 and subsequent Active Directory domains.[16] Kerberos is typically used when a server belongs to a Windows Server domain. Microsoft recommends developers neither to use Kerberos nor the NTLM Security Support Provider (SSP) directly.[21]

> Your application should not access the NTLM security package directly; instead, it should use the Negotiate security package. Negotiate allows your application to take advantage of more advanced security protocols if they are supported by the systems involved in the authentication. Currently, the Negotiate security package selects between Kerberos and NTLM. Negotiate selects Kerberos unless it cannot be used by one of the systems involved in the authentication.

### Use of the NTLM Security Support Provider[edit]

The NTLM SSP is used in the following situations:

* The client is authenticating to a server that doesn't belong to a domain or no Active Directory domain exists (commonly referred to as "workgroup" or "peer-to-peer")
* The server must have the "password-protected sharing" feature enabled, which is not enabled by default and which is mutually exclusive with HomeGroup on some versions of Windows.
* When server and client both belong to the same HomeGroup, a protocol similar to Kerberos, Public Key Cryptography based User to User Authentication will be used instead of NTLM.[22] HomeGroup is probably the easiest way to share resources on a small network, requiring minimal setup, even compared to configuring a few additional users to be able to use password-protected sharing, which may mean it is used much more than password-protected sharing on small networks and home networks.
* If the server is a device that supports SMB, such as NAS devices and network printers, the NTLM SSP may offer the only supported authentication method. Some implementations of SMB or older distributions of e.g. Samba may cause Windows to negotiate NTLMv1 or even LM for outbound authentication with the SMB server, allowing the device to work although it may be loaded with outdated, insecure software regardless of whether it were a new device.
* If the server is a member of a domain but Kerberos cannot be used.
* The client is authenticating to a server using an IP address (and no reverse name resolution is available)
* The client is authenticating to a server that belongs to a different Active Directory forest that has a legacy NTLM trust instead of a transitive inter-forest trust
* Where a firewall would otherwise restrict the ports required by Kerberos (typically TCP 88)

### Use of protocol versions[edit]

After it has been decided either by the application developer or by the Negotiate SSP that the NTLM SSP be used for authentication, Group Policy dictates the ability to use each of the protocols that the NTLM SSP implements. There are five authentication levels.[23]

* Send LM & NTLM responses: Clients use LM and NTLM authentication, and never use NTLMv2 session security; DCs accept LM, NTLM, and NTLMv2 authentication.
* Send LM & NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication, and use NTLMv2 session security if server supports it; DCs accept LM, NTLM, and NTLMv2 authentication.
* Send NTLM response only: Clients use NTLM authentication only, and use NTLMv2 session security if server supports it; DCs accept LM, NTLM, and NTLMv2 authentication.
* Send NTLMv2 response only: Clients use NTLMv2 authentication only, and use NTLMv2 session security if server supports it; DCs accept LM, NTLM, and NTLMv2 authentication.
* Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only, and use NTLMv2 session security if server supports it; DCs refuse LM (accept only NTLM and NTLMv2 authentication).
* Send NTLMv2 response only\refuse LM & NTLM: Clients use NTLMv2 authentication only, and use NTLMv2 session security if server supports it; DCs refuse LM and NTLM (accept only NTLMv2 authentication).

DC would mean Domain Controller, but use of that term is confusing. Any computer acting as server and authenticating a user fulfills the role of DC in this context, for example a Windows computer with a local account such as Administrator when that account is used during a network logon.

Prior to Windows NT 4.0 Service Pack 4, the SSP would negotiate NTLMv1 and fall back to LM if the other machine did not support it.

Starting with Windows NT 4.0 Service Pack 4, the SSP would negotiate NTLMv2 Session whenever both client and server would support it.[24] Up to and including Windows XP, this used either 40- or 56-bit encryption on non-U.S. computers, since the United States had severe restrictions on the export of encryption technology at the time. Starting with Windows XP SP3, 128-bit encryption could be added by installing an update and on Windows 7, 128-bit encryption would be the default.

In Windows Vista and above, LM has been disabled for inbound authentication. Windows NT-based operating systems up through and including Windows Server 2003 store two password hashes, the LAN Manager (LM) hash and the Windows NT hash. Starting in Windows Vista, the capability to store both is there, but one is turned off by default. This means that LM authentication no longer works if the computer running Windows Vista acts as the server. Prior versions of Windows (back as far as Windows NT 4.0 Service Pack 4) could be configured to behave this way, but it was not the default.[25]

## Weakness and vulnerabilities[edit]

NTLM remains vulnerable to the pass the hash attack, which is a variant on the reflection attack which was addressed by Microsoft security update MS08-068. For example, Metasploit can be used in many cases to obtain credentials from one machine which can be used to gain control of another machine.[3][26] The Squirtle toolkit can be used to leverage web site cross-site scripting attacks into attacks on nearby assets via NTLM.[27]

In February 2010, Amplia Security discovered several flaws in the Windows implementation of the NTLM authentication mechanism which broke the security of the protocol allowing attackers to gain read/write access to files and remote code execution. One of the attacks presented included the ability to predict pseudo-random numbers and challenges/responses generated by the protocol. These flaws had been present in all versions of Windows for 17 years. The security advisory explaining these issues included fully working proof-of-concept exploits. All these flaws were fixed by MS10-012.[28][29]

In 2012, it was demonstrated that every possible 8-character NTLM password hash permutation can be cracked in under 6 hours.[30]

In 2019, this time was reduced to roughly 2.5 hours by using more modern hardware.[4][31] Also, Rainbow tables are available for eight- and nine-character NTLM passwords. Shorter passwords can be recovered by brute force methods.[32]

Note that the password-equivalent hashes used in pass-the-hash attacks and password cracking must first be "stolen" (such as by compromising a system with permissions sufficient to access hashes). Also, these hashes are not the same as the NTLMSSP_AUTH "hash" transmitted over the network during a conventional NTLM authentication.

## Compatibility with Linux[edit]

NTLM implementations for Linux include Cntlm[33] and winbind (part of Samba)[34] allow Linux applications to use NTLM proxies.

FreeBSD also supports storing passwords via Crypt (C) in the insecure NT-Hash form.[35]

## See also[edit]

* LAN Manager
* NTLMSSP
* Integrated Windows Authentication
* Kerberos

## References[edit]

1. ^ a b "Introduction", NT LAN Manager (NTLM) Authentication Protocol Specification, Microsoft, retrieved 2010-08-15
2. ^ a b "Session Security Details", NT LAN Manager (NTLM) Authentication Protocol Specification, Microsoft, retrieved 2010-08-15
3. ^ a b Takahashi, T (2009-12-17), "Reflecting on NTLM Reflection", FrequencyX Blog, IBM Internet System Security (ISS), archived from the original on 2009-12-31, retrieved 2010-08-14
4. ^ a b Claburn, Thomas (February 14, 2019). "Use an 8-char Windows NTLM password? Don't. Every single one can be cracked in under 2.5hrs". www.theregister.co.uk. Retrieved 2020-11-26.
5. ^ "Microsoft NTLM", MSDN, Microsoft, retrieved 2010-08-15
6. ^ "Message Syntax | section 2.2", NT LAN Manager (NTLM) Authentication Protocol Specification, Microsoft, retrieved 2010-08-15
7. ^ "Connection-Oriented", NT LAN Manager (NTLM) Authentication Protocol Specification (3.1.5.1 ed.), Microsoft, retrieved 2010-08-15
8. ^ "Connectionless", NT LAN Manager (NTLM) Authentication Protocol Specification (3.1.5.2 ed.), Microsoft, retrieved 2010-08-15
9. ^ "NEGOTIATE_MESSAGE", NT LAN Manager (NTLM) Authentication Protocol Specification (2.2.1.1 ed.), Microsoft, retrieved 2010-08-15
10. ^ "CHALLENGE_MESSAGE", NT LAN Manager (NTLM) Authentication Protocol Specification (2.2.1.2 ed.), Microsoft, retrieved 2010-08-15
11. ^ "AUTHENTICATE_MESSAGE", NT LAN Manager (NTLM) Authentication Protocol Specification (2.2.1.3 ed.), Microsoft, retrieved 2010-08-15
12. ^ a b "NTLM v1 Authentication", NT LAN Manager (NTLM) Authentication Protocol Specification (3.3.1 ed.), Microsoft, retrieved 2010-08-15
13. ^ "NTLM v2 Authentication", NT LAN Manager (NTLM) Authentication Protocol Specification (3.3.1 ed.), Microsoft, retrieved 2010-08-15
14. ^ What's New in Windows NT 4.0 Service Pack 4?
15. ^ How to enable NTLM 2 authentication, Support, Microsoft, 2007-01-25, retrieved 2010-08-14
16. ^ a b "Security Configuration", Microsoft Windows 2000 Security Hardening Guide, TechNet, Microsoft, retrieved 2010-08-14
17. ^ Glass, Eric, "NTLM", Davenport, Source forge
18. ^ Varughese, Sam (February 2006). "Rainbow Cracking and Password Security". Palisade. Archived from the original on 2010-06-01. Retrieved 2010-08-14.
19. ^ "Security Considerations for Implementers", NT LAN Manager (NTLM) Authentication Protocol Specification, Microsoft, retrieved 2010-08-16
20. ^ "Active Directory Vulnerability Disclosure: Weak encryption enables attacker to change a victim's password without being logged - Aorato". Archived from the original on 2014-10-06. Retrieved 2014-10-05.
21. ^ "Microsoft NTLM". TechNet Library. Microsoft. Retrieved 2 November 2015.
22. ^ "Public Key Cryptography based User to User Authentication Overview". TechNet Library. Microsoft. Retrieved 2 November 2015.
23. ^ "LAN Manager authentication level". MSDN Library. Microsoft. Retrieved 2 November 2015.
24. ^ "Windows Authentication". TechNet Library. Microsoft. June 29, 2011. Retrieved 2 November 2015.
25. ^ Jesper Johansson. "The Most Misunderstood Windows Security Setting of All Time". TechNet Magazine. Microsoft. Retrieved 2 November 2015.
26. ^ HD Moore. "MS08-068: Metasploit and SMB Relay".
27. ^ Kurt Grutzmacher (2008-08-08). Nail the Coffin Shut, NTLM is Dead. Defcon 16.
28. ^ Hernan Ochoa and Agustin Azubel (2010-07-28). Understanding the Windows SMB NTLM Weak Nonce vulnerability (PDF). Blackhat USA 2010.
29. ^ Hernan Ochoa and Agustin Azubel. "Windows SMB NTLM Weak Nonce vulnerability Security Advisory".
30. ^ Goodin, Dan (2012-12-10). "25-GPU cluster cracks every standard Windows password in <6 hours". Ars Technica. Retrieved 2020-11-23.
31. ^ hashcat (2019-02-13). "hand-tuned hashcat 6.0.0 beta and 2080Ti (stock clocks) breaks NTLM cracking speed mark of 100GH/s on a single compute device". @hashcat. Retrieved 2019-02-26.
32. ^ A Case for Modern Rainbow Table Usage
33. ^ "Cntlm: Fast NTLM Authentication Proxy in C".
34. ^ "NTLM authentication - MoodleDocs".
35. ^ "NT MD4 password hash as new password encryption method for FreeBSD". Mail-archive.com. Retrieved 2 December 2018.

## External links[edit]

* Online NTLM hash crack using Rainbow tables
* NT LAN Manager (NTLM) Authentication Protocol Specification
* Cntlm – NTLM, NTLMSR, NTLMv2 Authentication Proxy and Accelerator Personal HTTP(S) and SOCKS5 proxy for NTLM-unaware applications (Windows/Linux/UNIX)
* The NTLM Authentication Protocol and Security Support Provider A detailed analysis of the NTLM protocol.
* MSDN article explaining the protocol and that it has been renamed
* MSDN page on NTLM authentication
* Libntlm – a free implementation.
* NTLM Authorization Proxy Server software that allows users to authenticate via an MS Proxy Server.
* Installing NTLM authentication – NTLM set-up instructions for Samba and Midgard on Linux
* NTLM version 2 (NTLMv2) and the LMCompatibilityLevel setting that governs it
* Jespa – Java Active Directory Integration Full NTLM security service provider with server-side NETLOGON validation (commercial but free up to 25 users)
* EasySSO - NTML Authenticator for JIRA NTLM Authenticator utilising Jespa library to provide IWA for Atlassian products.
* ntlmv2-auth NTLMv2 API and Servlet Filter for Java
* A ntlm message generator tool
* WAFFLE – Java/C# Windows Authentication Framework
* objectif-securite (Rainbow tables for ophcrack)
* Px for Windows \- An HTTP proxy server to automatically authenticate through an NTLM proxy

* v
* t
* e

Authentication

Authentication
APIs|

* BSD Authentication (BSD Auth)
* eAuthentication (eAuth)
* Generic Security Services API (GSSAPI)
* Java Authentication and Authorization Service (JAAS)
* Pluggable Authentication Modules (PAM)
* Simple Authentication and Security Layer (SASL)
* Security Support Provider Interface (SSPI)
* XCert Universal Database API (XUDA)

Authentication
protocols|

* ACF2
* Authentication and Key Agreement (AKA)
* CAVE-based authentication
* Challenge-Handshake Authentication Protocol (CHAP)
* MS-CHAP
* Central Authentication Service (CAS)
* CRAM-MD5
* Diameter
* Extensible Authentication Protocol (EAP)
* Host Identity Protocol (HIP)
* IndieAuth
* Kerberos
* LAN Manager
* NT LAN Manager (NTLM)
* OAuth
* OpenID
* OpenID Connect (OIDC)
* Password-authenticated key agreement protocols
* Password Authentication Protocol (PAP)
* Protected Extensible Authentication Protocol (PEAP)
* Remote Access Dial In User Service (RADIUS)
* Resource Access Control Facility (RACF)
* Secure Remote Password protocol (SRP)
* TACACS
* Woo–Lam

* Category
* Commons

* v
* t
* e

Microsoft Windows

* Components
* History
* Timeline
* Criticism

DOS-based|

* Windows 1.0x
* Windows 2.0x
* Windows 2.1x
* Windows 3.0
* Windows 3.1x

Windows 9x|

* Windows 95
* Windows 98
* Windows Me

Windows NT|

* NT 3.1
* NT 3.5
* NT 3.51
* NT 4.0
* 2000
* XP
* Pro x64
* Media Center
* Fundamentals for Legacy PCs
* Vista
* 7
* 8, 8.1
* Windows RT
* 10
* 11

Windows Server|

* Server 2003
* Home Server
* Server 2008
* EBS 2008
* HPC Server 2008
* Server 2008 R2
* Home Server 2011
* Server 2012
* Server 2012 R2
* Server 2016
* Server 2019
* Server 2022
* MultiPoint Server
* Server Essentials

Specialized|

* Windows Preinstallation Environment
* Windows IoT
* Windows 365

Windows IoT|

* Modular Windows
* Embedded Compact
* CE 5.0
* Embedded CE 6.0
* Embedded Compact 7
* Embedded Automotive
* Embedded Industry

Windows Mobile|

* Pocket PC 2000
* Pocket PC 2002
* Mobile 2003
* Mobile 5.0
* Mobile 6.0
* Mobile 6.1
* Mobile 6.5

Windows Phone|

* Phone 7
* Phone 8
* Phone 8.1
* 10 Mobile

Cancelled|

* Cairo
* Nashville
* Neptune
* Odyssey

Related|

* Development
* 95
* XP
* Vista
* 10
* 11
* Editions
* XP
* Vista
* 7
* 8
* 10
* New features
* XP
* Vista
* 7
* 8
* 10
* 11
* Removed features
* XP
* Vista
* 7
* 8
* 10
* 11
* Version history
* Phone
* 10
* 10 Mobile
* 11
* Criticism
* XP
* Vista
* 10
* Vista vs. XP

* List of versions
* Comparison
* Category

* v
* t
* e

Microsoft Windows components

Management
tools|

* App Installer
* Command Prompt
* Control Panel
* Applets
* Device Manager
* Disk Cleanup
* Drive Optimizer
* Driver Verifier
* DxDiag
* Event Viewer
* IExpress
* Management Console
* Netsh
* Performance Monitor
* Recovery Console
* Resource Monitor
* Settings
* Sysprep
* System Configuration
* System File Checker
* System Information
* System Policy Editor
* System Restore
* Task Manager
* Windows Error Reporting
* Windows Ink
* Windows Installer
* PowerShell
* Windows Update
* Windows Insider
* WinRE
* WMI

Apps|

* 3D Viewer
* Clock
* Calculator
* Calendar
* Camera
* Character Map
* Cortana
* Edge
* Fax and Scan
* Feedback Hub
* Get Help
* Magnifier
* Mail
* Maps
* Messaging
* Media Player
* Windows 11
* Movies & TV
* Mobility Center
* Money
* News
* Narrator
* Notepad
* OneDrive
* OneNote
* Paint
* Paint 3D
* People
* Phone Link
* Photos
* Quick Assist
* Snipping Tool
* Speech Recognition
* Skype
* Sports
* Sticky Notes
* Store
* Tips
* Voice Recorder
* Weather
* WordPad
* Xbox (app)

Shell|

* Action Center
* Aero
* AutoPlay
* AutoRun
* ClearType
* Explorer
* Search
* Indexing Service
* IFilter
* Saved search
* Namespace
* Special folder
* Start menu
* Taskbar
* Task View
* Windows Spotlight
* Windows XP visual styles

Services|

* Service Control Manager
* BITS
* CLFS
* Multimedia Class Scheduler
* Shadow Copy
* Task Scheduler
* Error Reporting
* Wireless Zero Configuration

File systems|

* CDFS
* DFS
* exFAT
* IFS
* FAT
* NTFS
* Hard link
* links
* Mount Point
* Reparse point
* TxF
* EFS
* ReFS
* UDF

Server|

* Domains
* Active Directory
* DNS
* Group Policy
* Roaming user profiles
* Folder redirection
* Distributed Transaction Coordinator
* MSMQ
* Windows Media Services
* Active DRM Services
* IIS
* WSUS
* SharePoint
* Network Access Protection
* PWS
* DFS Replication
* Print Services for UNIX
* Remote Desktop Services
* Remote Differential Compression
* Remote Installation Services
* Windows Deployment Services
* System Resource Manager
* Hyper-V
* Server Core

Architecture|

* Architecture of Windows NT
* Startup process
* NT
* NT 6
* CSRSS
* Desktop Window Manager
* Portable Executable
* EXE
* DLL
* Enhanced Write Filter
* Graphics Device Interface
* hal.dll
* I/O request packet
* Imaging Format
* Kernel Transaction Manager
* Library files
* Logical Disk Manager
* LSASS
* MinWin
* NTLDR
* Ntoskrnl.exe
* Object Manager
* Open XML Paper Specification
* Registry
* Resource Protection
* Security Account Manager
* Server Message Block
* Shadow Copy
* SMSS
* System Idle Process
* USER
* WHEA
* Win32 console
* Winlogon
* WinUSB

Security|

* Security and Maintenance
* AppLocker
* BitLocker
* Credential Guard
* Data Execution Prevention
* Family Safety
* Kernel Patch Protection
* Mandatory Integrity Control
* Protected Media Path
* User Account Control
* User Interface Privilege Isolation
* Windows Defender
* Windows Firewall

Compatibility|

* COMMAND.COM
* WoW64
* Windows Subsystem for Linux

API|

* Active Scripting
* WSH
* VBScript
* JScript
* COM
* ActiveX
* ActiveX Document
* COM Structured storage
* DCOM
* OLE
* OLE Automation
* Transaction Server
* DirectX
* .NET
* Universal Windows Platform
* Windows Mixed Reality
* Windows Runtime
* WinUSB

Games|

* Solitaire Collection
* Surf

Discontinued|

| Games|

* 3D Pinball
* Chess Titans
* FreeCell
* Hearts
* InkBall
* Hold 'Em
* Purble Place
* Spider Solitaire
* Solitaire
* Tinker

|

Apps|

* ActiveMovie
* Anytime Upgrade
* Address Book
* Backup and Restore
* Cardfile
* CardSpace
* CD Player
* Chat
* Contacts
* Desktop Gadgets
* Diagnostics
* DriveSpace
* DVD Maker
* Easy Transfer
* Fax
* Food & Drink
* Groove Music
* Help and Support Center
* Health & Fitness
* HyperTerminal
* Imaging
* Internet Explorer
* Journal
* Media Center
* Meeting Space
* Messaging
* Messenger
* Mobile Device Center
* Movie Maker
* MSN Dial-up
* NetMeeting
* NTBackup
* Outlook Express
* Phone Companion
* Photo Gallery
* Photo Viewer
* Program Manager
* Steps Recorder
* Syskey
* Travel
* WinHelp
* Write

Others|

* ScanDisk
* File Protection
* Media Control Interface
* Next-Generation Secure Computing Base
* POSIX subsystem
* HPFS
* Interix
* Video for Windows
* Virtual DOS machine
* Windows on Windows
* Windows SideShow
* Windows Services for UNIX
* Windows System Assessment Tool
* Windows To Go
* WinFS

Spun off to
Microsoft Store|

* DVD Player
* File Manager
* Hover!
* Mahjong
* Minesweeper

Defunct|

* Pay

* Category
* List

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template