Windows and Kerberos security system for client/server authentication have a long and tortured relationship. Security experts say there’s no real way to avoid these attacks. The attacks are called Pass-the-Hash and Golden Ticket. They work because NT LAN Manager (NTLM) creates secret keys using NTLMs hash of an inactive user account. The inactive user krbtgt is created when the system is first installed and typically remains untouched on Windows machines for a long time. This allows cybercriminals to access the hash and then gain the ability to execute certain administrative commands.”]