Windows EventInformation
Windows Event ID 4816 – Security-Auditing: NTLM Authentication Package Loaded
Event ID 4816 indicates that the NTLM authentication package has been loaded by the Local Security Authority (LSA). This security audit event tracks when NTLM authentication capabilities are initialized on Windows systems.
