Comment by mr_mitm

This is mostly an issue in active directory networks. Usually the reason people give as to why they still have this enabled is due to some legacy system that can't authenticate via Kerberos or at least NetNTLMv2. Worst case is if they then enable NetNTLMv1 on the domain controllers, even if the DC acts as a client. Using authentication coercion, this is a pretty quick win for an adversary.