A security analyst is migrating a pass-the-hash vulnerability on a Windows infrastructure. Given the requirement, which of the following should the security analyst do to MINIMIZE the risk?

Enabling CHAP is irrelevant for preventing pass-the-hash attacks on a Windows infrastructure as CHAP is primarily used for dial-up or VPN connections and does not address NTLM hash vulnerabilities.

Pass-the-hash attacks commonly succeed by capturing and reusing NTLM hashes for authentication without knowing the plaintext password. Disabling NTLM on a Windows infrastructure directly removes the vulnerable authentication mechanism, thereby preventing the exploitation of NTLM hashes and compelling systems to rely on stronger protocols like Kerberos for authentication.

While Kerberos is a more secure authentication protocol, simply enabling it does not inherently prevent systems from still accepting NTLM authentication, which is the protocol vulnerable to pass-the-hash attacks.

Disabling PAP is not relevant to mitigating pass-the-hash attacks, as PAP is an outdated clear-text authentication protocol primarily used in PPP connections, completely unrelated to NTLM hash vulnerabilities.