1. NTLM challenge/response
Application server
Windows NT domain controller
MSV1_0
Netlogon
4. Server impersonates client
Windows NTDirectory Service