Simple NTLM

What APM version are you on? If you create a new NTLMV2 SSO profile, the default username and password sources should be session.sso.token.last.username and session.sso.token.last.password, respectively. In any case, the SSO credential mapping agent takes the password variable you specify (the encrypted session.logon.last.password value from the logon page by default), decrypts it, and puts that decrypted value into session.sso.token.last.password.