Getting ntlm_auth to Speak Squid's Helper Protocol
A successful one-shot password check does not establish that ntlm_auth is running the persistent protocol Squid expects.
For Squid NTLM authentication, examine whether the effective helper command selects --helper-protocol=squid-2.5-ntlmssp. The historical number names the helper conversation; it does not tell you to install Squid 2.5.
A one-shot ntlm_auth username/password check tests another mode. Its success does not establish that Squid launched a helper capable of maintaining the required exchange.
Read the complete command in the loaded auth_param configuration and preserve its arguments while investigating the child's startup or exit message. Then check the conversation: Squid sends protocol messages on standard input and expects protocol replies on standard output. A wrapper's welcome banner or debug print there can break integration before credentials are evaluated. Send diagnostics to standard error.
Check the account running the helper separately from the user being authenticated. Access to Samba's privileged authentication facilities is a local service-permission question. Changing the user's password cannot grant it.
Once the helper remains available and speaks the selected protocol, move to domain membership, account acceptance and browser negotiation. Raising the helper count earlier only launches more copies of the same failing integration.