When it has been determined that the NTLM authentication protocol should not be used within a network because you are required to use a more secure protocol, such as the Kerberos protocol, then you can select from several options based on your security goals to restrict NTLM usage within the domain.