Defending against NTLM relay:

**SMB Signing** — Mandatory SMB signing prevents relay by requiring packet signing with the session key - **EPA (Extended Protection for Authentication)** — Binds NTLM authentication to the TLS channel - **Disable LLMNR and NBT-NS** — Removes the primary trigger for relay attacks - **Network segment