Microsoft is preparing one of the most consequential security shifts in Windows in decades, turning off NTLM authentication by default and pushing organizations toward modern, Kerberos based sign in.