* You can now specify a domain as the last parameter of ntlm authentication ['user','password','domain']. If the domain is omitted we assume that you want to authenticate to the local server. (Note that this is a behavior change from the current implementation) Currently, if you did not specify a domain it would select the default target which is the machine for a non-domain joined machine, or the domain for a domain joined machine.

* Some newer microsoft services only allow Negotiate authentication. Negotiate will degrade to NTLM authentication and is 100% compatible with the NTLM scheme. The client will now query the server for valid auth types and use Negotiate or NTLM in that order. If the auth type is not supported we try NTLM anyhow.

* Type 1 Packets where malformed because they did not include the domain and workstation. In the general case, these should always be null for a type 1 packet. This is purely aesthetic, but the inclusion of this information quiets wireshark warnings about the packet being malformed. Note: Chrome, Firfox and Curl also fill these values in a null by default.

* Type 2 Packets were missing the Workstation name. This is now included by default.

* Type 2 Packets were missing the target domain. Without this the server would try to authenticate using the default target (my first comment on the behavior change).