HackBlue

Tools · Active Directory defense · 07 / 23

How to audit and reduce NTLM authentication in Active Directory

Find where NTLM is still used with the NTLM Operational log and 4624 events, disable NTLMv1 and LM, and plan a gradual NTLM restriction.

10 min read · practice only with authorization

Why NTLM is a risk

NTLM is the older challenge-response protocol Windows falls back to when Kerberos is unavailable: connecting by IP address, to a non-domain machine, or with an application that does not support Kerberos. It does not provide mutual authentication, so it is susceptible to relay attacks, and NTLMv1 and LM responses can be cracked quickly.

Microsoft has announced the deprecation of NTLM. Reducing it now makes that transition easier.

See where it is used

On domain controllers, enable “Network security: Restrict NTLM: Audit NTLM authentication in this domain” and on servers “Audit incoming NTLM traffic”. Events then appear in Microsoft-Windows-NTLM/Operational, for example 8004 on DCs naming the user, the workstation, and the server being accessed. 4624 events also show Authentication Package NTLM and the Package Name NTLM V1 or V2.

Group the results by source and destination to find the applications and devices to fix.

Snippet
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-1)} |
  % { $x=[xml]$_.ToXml(); $d=@{}; $x.Event.EventData.Data | % { $d[$_.Name]=$_.'#text' }; if ($d.AuthenticationPackageName -eq 'NTLM') { [pscustomobject]@{User=$d.TargetUserName; From=$d.WorkstationName; Ver=$d.LmPackageName} } } |
  Group-Object Ver, From | Sort Count -Descending | Select -First 20 Count, Name

Lab: disable NTLMv1 and measure

Set “Network security: LAN Manager authentication level” to “Send NTLMv2 response only. Refuse LM & NTLM” (level 5) in the Default Domain Policy for the lab. Ensure “Do not store LAN Manager hash value on next password change” is enabled. Then connect to a share by IP address from the workstation and confirm the 4624 shows NTLM V2.

Next, enable audit-only NTLM restriction on the DC for a day, read the 8004 events, and list what would break if you blocked NTLM.

Snippet
Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name LmCompatibilityLevel, NoLMHash
Get-WinEvent -LogName 'Microsoft-Windows-NTLM/Operational' -MaxEvents 20 | Format-Table TimeCreated, Id, Message -Wrap

A realistic plan

Disable NTLMv1 and LM everywhere first; it is rarely needed. Fix the biggest NTLM sources: use DNS names instead of IP addresses, register SPNs for services, and update old applications. Add privileged accounts to Protected Users, which blocks NTLM for them. Then use server exceptions and block NTLM incrementally.

Combine with relay defenses, covered next: SMB signing, LDAP signing and channel binding, and Extended Protection for Authentication.

Diagram

Reducing NTLM step by step

  1. Audit

    Enable NTLM auditing on DCs and servers.

  2. Kill v1

    LmCompatibilityLevel 5 and no LM hashes.

  3. Fix sources

    DNS names, SPNs, and application updates.

  4. Restrict

    Protected Users for admins, then block with exceptions.

Check yourself

1. Why is NTLM more exposed to relay attacks than Kerberos?

2. Which common habit forces NTLM instead of Kerberos?

3. Which LmCompatibilityLevel refuses LM and NTLMv1?