Auditing NTLMv1

Question

Hi,

I have enabled NTLM auditing to discover any use of NTLMv1.

As I understand I can look for events under Applications and Services Log\Microsoft\Windows\NTLM

I do see the following events but not sure if there is NTLMv1 traffic blocked here. From the image below it tells me that user identity is my domain controller, and domain identity is my domain name. This is eventID 8002, so not sure if that is defined like "NTLMv1 traffic blocked" ? I understand that this will be blocked if i disable NTLMv1, but from the message below, I am not sure what I am blocking.

Reference: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain?source=recommendations

When I see some other documentation, I am supposed to look for eventid 4624, which ofcourse also contains Kerberose, so I see 1000000+ of these events in the security log. Not so easy to look for NTLMv1 within this.

Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/audit-domain-controller-ntlmv1

So any comments on how to "easy" look for NTLMv1 traffic.

Thanks for any reply

/R

Andy

Answer 1

Hello

Thank you for your question and reaching out. I can understand you are having query\issues related to NTLM Traffic.

These policy settings will report what is using NTLM without blocking anything:

Computer Configuration->Policies->Windows Settings->Security Settings->Security Options->Network security: Restrict NTLM: Audit NTLM authentication in this domain. Policy Setting: Audit All

Computer Configuration->Policies->Windows Settings->Security Settings->Security Options->Network security: Restrict NTLM: Audit Incoming NTLM Traffic. Policy Setting: Enable auditing for all accounts

Computer Configuration->Policies->Windows Settings->Security Settings->Security Options->Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers. Policy Setting: Audit all

After enabling these policies, Event ID 8001, 8002, 8003, and 8004 will be recorded in Event Viewer under Applications and Services Logs->Microsoft->Windows->NTLM->Operational.

Reference :

https://learn.microsoft.com/en-us/answers/questions/979382/microsoft-windows-server-has-detected-that-ntlm-au

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Hi @Andreas

When you enable NTLM audit , you can identify NTLMv1 in the PackageName of the event 4624. You can use a Powershel script to check in the event viewer of all domain controllers:

Some links talk about how you can detect NTLMv1 authentication and disabled it:

How to Disable NTLM Authentication in Windows Domain?

HOWTO: Detect NTLMv1 Authentication

Please don't forget to mark helpful answer as accepted