Need some help to target the Group Policy to enable the NTLM audit?

EnterpriseArchitect 4,741 Reputation points
2024-04-18T12:53:32+00:00

I must audit any computers still using NTLM v1 in my AD Domain. Do I need to enable these group policies for all Windows servers and workstations in my AD Domain or just the Domain Controllers?

  • Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
    Policy Setting
    Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings Enabled
    Network security: Restrict NTLM: Audit Incoming NTLM Traffic Enable auditing for all accounts
    Network security: Restrict NTLM: Audit NTLM authentication in this domain Enable all
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,881 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,756 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,724 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,377 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,069 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yanhong Liu 2,005 Reputation points Microsoft Vendor
    2024-04-19T06:01:42.2733333+00:00

    Hello,

    Thank you for posting in Q&A forum.

    If you want to confirm that any computers domain-wide are still using NTLM v1, you can edit the default domain policy on the domain controller. The default domain policy is a predefined Group Policy Object (GPO) that applies to all computers and users throughout the domain. You no longer need to enable these group policies individually for all Windows servers and workstations in the AD domain.

    In Group Policy Editor, navigate to the Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options path, and then configure the following policy:

    Network Security: LAN Manager Authentication Level: Set the authentication level to disable NTLMv1, such as "Send NTLMv2 response only, deny LM & NTLM". When a client or service trying to use NTLMv1 is rejected, the system logs relevant events (such as event ID 4625, login failed) and mentions in the event details that the reason for the authentication failure is related to NTLMv1. By analyzing these failed login events, you can identify which clients or services are still trying to use NTLMv1.

    Also navigate to Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policies

    Audit: Audit login events: set to "success" and "failure". When this setting is enabled, the system logs login events for successful or failed attempts, including login attempts using NTLMv1.

    I hope the information above is helpful.

    Best Regards,

    Yanhong Liu

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

  2. sumaiyaaisha 0 Reputation points
    2024-04-29T08:39:42.1833333+00:00

    Certainly! To enable NTLM audit via Group Policy:

    Open Group Policy Management Console.

    Navigate to the desired Group Policy Object (GPO).

    Go to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies.

    Enable "Audit NTLM authentication in this domain" and configure the desired auditing level.

    Link the GPO to the appropriate organizational unit (OU) or domain.

    This will enforce NTLM audit policies across the specified domain or organizational unit, enhancing security and compliance measures.

    If anyone want to know about car parking multiplayer mod visit her

    0 comments