Domain Controller enable NTLM Audit

Question

Hello,

May i know which gpo policy will need to configure to check NTLM auditing on domain controllers?

What will be the eventid to check?

Answer 1

You have to navigate to

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

And configure Network Security: Restrict NTLM: Audit NTLM authentication in this domain

Log files will be on operational event log under Applications and Services Log\Microsoft\Windows\NTLM in the Event Viewer.

Take a look at:
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain

Answer 2

Also, you can check Event id - 4624 while authentication.

NTLM in the Authentication Package value, than the NTLM protocol has been used to authenticate this user

Package Name will show which protocol LM, NTLMv1 or NTLMv2 has been used for authentication

Answer 3

@Reza-Ameri ,

Does this mean that only NTLM authentication that are denied will be logged?

Our objective here is to audit successful NTLM connections so that we can inform the service owner to change the authentication to Kerberos.
Please advise whether there is a setting to audit successful authentication.