Ironically enough, the things that tend to break first when you try to turn off NTLM are still Microsoft products like ADCS.