Which version of NTLM is logged with the NTLM Audit GPO's?

Question

Does anyone know if the following two GPO's log only NTLM (v1) or both v1 and v2? Or do we have to enable "Logon Success Auditing" to figure that out?

Network security: Restrict NTLM: Audit NTLM authentication in this domain

Network security: Restrict NTLM: Audit incoming NTLM traffic

Answer 1

Hi p0shkar,

These Restrict NTLM GPOs will audit both NTLM and NTLM v2 traffic.

Best Regards,

Ian Xue

---

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi @p0shkar

Network security: Restrict NTLM: Audit NTLM authentication in this domain
Network security: Restrict NTLM: Audit incoming NTLM traffic => these seetings should be enough to enable NTLMv1 audit and identify the server still using this protocol by checking the event 4624.

You can also enable "Logon Success Auditing if you want get more details but it's not required.

I invite you to read the following link for more details:

Auditing and restricting NTLM authentication using Group Policy

---

Please don't forget to accept helpful answer

Answer 3

Thanks both for the answers!