Intune Settings Catalog "Local Policies Security Option"

Question

Intune Settings Catalog "Local Policies Security Option"

David Rechtenbach 46

Hello,

The security recommendations in the security.microsoftcom portal shows me following recommendation:
Set LAN Manager authentication level to 'Send NTLMv2 response only. Refuse LM & NTLM'

Ich found in the Settingscatalog following setting:

Which setting should i choose for NTLMv2 response only? If i use "Send LM and NTLMv2 response only. Refuse LM and NTLM" i found in the registry this

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\LocalPoliciesSecurityOptions\NetworkSecurity_LANManagerAuthenticationLevel

I would expected Value 5 and not 3. The recommendations in the security.microsoftcom portal is still present.

Accepted answer

1 additional answer

Your answer

Answer 1

Lu Dai-MSFT 28,501

@David Rechtenbach Thanks for posting in our Q&A.

Based on my research, the correct registry location is "HKLM\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel".
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level#registry-location

When this policy with "Send NTLMv2 response only. Refuse LM & NTLM" is deployed successfully, LmCompatibilityLevel value is "5".

Hope it will help.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Lu Dai-MSFT 28,501 Reputation points

2022-12-12T06:11:37.793+00:00

@David Rechtenbach Is there any other assistance that we can provide? If you have any questions or concerns on the recent information I've provided you, please don't hesitate to let me know.
Lu Dai-MSFT 28,501 Reputation points

2022-12-20T02:34:08.53+00:00

@David Rechtenbach Haven't heard from you for some time. If you have a chance to review this thread, please check if my reply is helpful. If yes, please accept my answer, it will make someone else who has this similar issue easily find the solution.

Thanks for your kindness in advance.

Answer 2

Hello there,

The LAN Manager Authentication Level setting determines which authentication protocol Windows should accept to authenticate users to a given network resource. LAN Manager authentication includes the LM, NTLM, and NTLMv2 protocols.The safest of them is the NTLMv2 protocol as it mitigates replay attacks. LAN Manager Authentication policy must be set to accept NTLMv2 authentication and refuse LM and NTLM authentication.

Follow the below steps in GPO to resolve the misconfiguration. Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".

--------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

Share via

Intune Settings Catalog "Local Policies Security Option"

1 additional answer

Your answer