detect NTLM runtime