On systems or services using NTLM authentication, users' passwords are never sent in cleartext over the wire.
Native Windows applications ask users for the cleartext password, then call APIs like LsaLogonUser[REF] that convert that password to one or two hash values (the LM or NT hashes) and then send that to the remote server during NTLM authentication [REF].