I can't find anything in the online help and no obvious settings.

This is not a SmarterMail issue.  NTLM and Kerberos are the two protocols that Windows can use between workstation and Domain Controller for user authentication.  NTLM can be disabled by group policy, as long as you know that Kerberos is working correctly and all of your devices are new enough to use Kerberos.  All currently supported operating systems should prefer Kerberos.

How is it not a SmarterMail issue? It is SmarterMail that responds to auth ntlm with 334 ntlm supported, not windows.

We're also running into recommendations that NTLM be disabled for authentication on our mail server infrastructure. This is one thing ME does support is control of authentication methods.

I can't find anything in the online help and no obvious settings.

Thanks for starting this discussion.  It made me start researching.   

Seems like a feature request ticket is in order.   Related issues that may be auditor-driven:

- Disable SMTP AUTH login completely, particularly on port 25.   Authenticated logins should always use a submission port.

- Disable the "LOGIN" authentication method so that only CRAM-MD5 is permitted.

Is anyone aware of requirements for a stronger alternative to CRAM-MD5?

I am pretty sure that this is still a Windows issue, because SmarterMail is almost certainly depending on Windows to perform the NTLM authentication step.  If Windows has it disabled, SmarterMail will not be able to complete the authentication.   But Support should be able to clarify this.

Resources that I found:

The first evidence that NTLM is enabled on your server is in Event Viewer, Event ID 6038 from LSA (LsaSrv).

This article describes the GPO setting for specifying NTLM restrictions:

The assumption is to start with auditing, and then proceed to lock down in stages, which may require creating exceptions for certain servers.

   

Some of the other articles that I found made a distinction between NTLMv1 and NTLMv2.   It seems that the best practice these days is to disable both for best security