KeyUsage

KeyUsage ::= BIT STRING 

{
  digitalSignature   (0), -- verify signature of the certificate, entity authentication
  nonRepudiation     (1), -- recent editions of X.509 have
                          -- renamed this bit to contentCommitment
  keyEncipherment    (2), -- use to encrypt asymmetric private keys 

                          -- or symmetric keys for key transport

  dataEncipherment   (3), -- this will never be set, because keyAgreement is norm
  keyAgreement       (4), -- deriving Symmetric key from public key without encryption,
  keyCertSign        (5), -- for CA Certificates only

                          -- used to verify signatures of public key certificates
  cRLSign            (6),
  encipherOnly       (7), -- valid if keyAgreement is set, encrypts data while 

                          -- performing key management
  decipherOnly       (8)  -- valid if keyAgreement is set, decrypts data while  

                          -- performing key management

}

http://tools.ietf.org/html/rfc5280#page-29
http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=%2Fcom.ibm.help.domino.admin.doc%2FDOC%2FH_KEY_USAGE_EXTENSIONS_FOR_INTERNET_CERTIFICATES_1521_OVER.html

NTLM

Nice read here and here and here

In nutshell, Kerberos is better than NTLM. Kerberos contact Domain Controller, gets token and uses it to authenticate user. NTLM contacts Web Server which in turn contacts Domain Controller, gets token and authenticates it. Normally Web sites can be set to use only NTLM or Negotiate(Kerberos will be tried, on failure NTLM will be tried). Just refer below fiddler screen shots for some clue.