3.1.4 Higher-Layer Triggered Events

The NTLM logon message exchange MUST be triggered by a server requesting user authentication via the Netlogon remote procedure call (RPC) mechanism to the domain controller (DC).