The provided user credentials must be an administrator of the configured site collection.
Navigate to the owners page for the Sharepoint server: http://<domain>/_admin/owners.aspx. The page should look like the following (for domain sp-onprem-2016 and site collection /sites/TeamSiteCollection1)
Ensure the account used for authenticating via NTLM is a site collection administrator (listed in any of the above boxes).