title: NTLM authentication over HTTP
body: <p>I am wondering if we are using NTLM (Windows) authentication - how server determines if user is already logged on or not. So when I first time access the site - the server tells me he want to authenticate me via NTLM:</p>
  
  <pre><code>WWW-Authenticate: Negotiate
  WWW-Authenticate: NTLM
  </code></pre>
  
  <p>Then client and server exchanging few requests - actually challenge/response phase happens here, particularly server generates and sends challenge to client, client calculates response based on it and sends back, and then server contact Domain Controller to verify it. Ok, we're done.</p>
  
  <p>But when I am authenticated and go to any page, there are no any authentication headers anymore. How does server know that I'm already authenticated?</p>
  
  <p>P.S. I thought IIS ties client by MAC or IP but indeed that's not true. NTLM works for single browser. Also no NTLM specific cookies were found.</p>