I am having a difficult time understanding NTLM for example I was told that NTLM is a hash algorithim but I researched it and I found NTLM uses MD5 so its not an algorithim as much as it is a protocol. If I am correct then when is NTLM used? Is it used during the logon to a system?
NTLM is a legacy (very old) proprietary single sign-on authentication protocol used by client operating systems to logon to a system by passing it's credentials onto Microsoft Active Directory. It was developed during the Windows NT days back in the 1990's and is still somewhat in use today, but that use has been widely diminishing for years now in favor of the industry-standard single sign-on authentication protocol known as kerberos. See the StackOverflow tag info on ntlm for further details.