Question: how does ntlm authentication works?
Answer: NTLM uses an encrypted challenge/response protocol to authenticate a user without sending the user's password over the wire. Instead, the system requesting authentication must perform a calculation that proves it has access to the secured NTLM credentials. ... The client sends the user name to the server (in plaintext).