LAN Manager authentication level Default Value for Windows 10 and Windows 11 client Machines.

Question

Hello,

In my Active Directory Domain environment, I have Windows 10 and Windows 11 client machines.

These machines do not have the "Network security: LAN Manager authentication level" configured.

I want to understand the default value that my Windows 10 and 11 systems will use when authenticating using the NTLM protocol.

-Send LM & NTLM responses

-Send LM & NTLM - use NTLMv2 session security if negotiated

-Send NTLM responses only

-Send NTLMv2 responses only

-Send NTLMv2 responses only. Refuse LM

-Send NTLMv2 responses only. Refuse LM & NTLM

Thanks Much.

Regards,

Raj

Answer 1

Hello raj a,

Thank you for posting in Q&A forum.

Based on the two similar threads below:
https://learn.microsoft.com/en-us/answers/questions/1091231/what-is-the-defualt-lan-manager-authentication-lev

https://learn.microsoft.com/en-us/archive/msdn-technet-forums/41ed0ba1-6a0f-4d5d-87de-401082a10a0c

And the default setting on DCs, member servers and stand-alone servers, it seems the default setting on Win 10 and Win 11 is Send NTLMv2 response only (Registry security level is 3).

Stand-Alone Server Default Settings:
Send NTLMv2 response only
DC Effective Default Settings:
Send NTLMv2 response only
Member Server Effective Default Settings:
Send NTLMv2 response only

Other reference:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.