Your Scripts Reach the File Share by IP Address and Windows Wants a Name

The nightly export
copies a file to a share.

Backslash backslash,
ten dot twenty dot zero dot fifteen,
backslash exports.

Someone wrote it years ago,
because the DNS name
was not working that week.

It has worked ever since.

And every night,
without telling you,
it signs in
with a protocol
Microsoft is retiring.

Here is the mechanism.

Windows has two ways
to prove who you are
to another machine
in a domain.

Kerberos,
the modern one,
and NTLM,
which is older than most of your code.

Kerberos issues a ticket
for a named service
on a named host.

The name is part of the ticket.

Give it a bare IP address,
and in most setups
there is no name to issue a ticket for.

So Windows quietly falls back
to NTLM,
and the connection works.

The same fallback happens
for machines that cannot reach
a domain controller,
for local accounts,
and for a lot of old devices
that never learned anything else.

None of it shows up as an error.

That is changing.

Microsoft declared NTLM deprecated
in 2024.

The oldest version, NTLMv1,
is already removed
in the newest Windows releases.

And Microsoft has said
it plans to turn NTLM off by default
in a future version,
and has been shipping
the auditing to find
what still uses it.

The day it goes off,
every share reached by number,
every scanner that saves to a folder,
every script with an IP in a path
will stop at the door.

So find them now,
while it still works.

Turn on NTLM auditing
on your servers
and read what it logs.

Search your scripts,
scheduled tasks and config
for paths that start
with two backslashes and a digit.

Replace each one with a name
that resolves,
and check it gets a Kerberos ticket.

List the devices
that cannot do anything else,
and decide what replaces them
before someone else decides for you.

The fallback was a kindness.

It kept old shortcuts working
long after anyone remembered taking them.

It will not be there forever.

– Serguey Asael Shinder