Regarding the reasons for using NTLM authentication in a cluster environment, I have summarized the following points for your reference:
1. Failover clusters rely on Active Directory for inter-node communication and resource management. Ideally, the cluster should use Kerberos for secure authentication, but in some cases, it may fall back to NTLM. <\/p>\n\n\n\n
2. If CSV or file shares use NTLM authentication, disabling NTLM will result in storage access failures. In this case, after disabling NTLM, issues arose with the CSV.<\/p>\n\n\n\n
3. In addition, normally, there might be no issues, but that’s only a possibility. As you mentioned in the case description, this problem occurred during password rotation and CLIUSR issue. <\/p>\n\n\n\n
Here’s the relevant document for your reference:<\/p>\n\n\n\n
Security Settings for Failover Clustering | Microsoft Community Hub<\/a><\/p>\n\n\n\n <\/p>\n\n\n\n So your going against Microsoft Hardening guidelines? <\/p>\n\n\n\n NTLM authentication: What it is and why it\u2019s risky<\/a><\/p>\n\n\n\n