ntlm auditing gpo

NP 386 Reputation points
2021-08-02T23:22:01.207+00:00

Just seeking some guidance on NTLM auditing. We are running Server 2019 at the latest domain and forest functional levels

I am just seeking some clarity around auditing NTLM traffic by GPO.

Which settings should be applied to the Domain Controllers only?

And which should only be applied to member servers and workstations?

I've come across a few articles which are confusing me.

This one says put the settings in the default domain policy:

https://knowledge.broadcom.com/external/article?legacyId=HOWTO79508

This article says the following:
https://learn.microsoft.com/en-us/archive/blogs/askds/ntlm-blocking-and-you-application-analysis-and-auditing-methodologies-in-windows-7

Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers = Audit All
Network security: Restrict NTLM: Audit NTLM authentication in this domain = Enable all
Network security: Restrict NTLM: Audit Incoming NTLM Traffic = Enable auditing for all accounts 

Note: Configure "Audit NTLM authentication in this domain" on DC's only. Configure "Outgoing NTLM traffic to remote servers" and "Audit Incoming NTLM Traffic" on all computers.

And this one just mentions applying specific auditing to DCs only:
https://adsecurity.org/?p=3377

I guess i am just seeking some clarification.

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,740 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,113 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,843 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,721 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Reza-Ameri 16,831 Reputation points
    2021-08-03T16:42:26.667+00:00

    The article from Microsoft is reliable since it is official.
    However, you reference to the older article and new one is this one:
    https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain
    It depends on your architecture you may do it in your main domain (especially those who required authentication).

    0 comments