How to Disable NTLM Authentication Protocol in Active Directory 2026

Before disabling NTLM, you need to understand where it's being used in your environment. Windows 11 24H2 and Windows Server 2025 include enhanced NTLM logging capabilities that make this process much more effective.

Open Group Policy Management Console and navigate to your domain policy or create a new GPO:

gpmc.msc

Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. Configure these auditing policies:

For Windows 11 24H2 and Server 2025, also enable the new enhanced logging policies under the same location.

gpupdate /force
# Check for NTLM events in Security log
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624,4625} | Where-Object {$_.Message -like '*NTLM*'} | Select-Object TimeCreated, Id, LevelDisplayName, Message

After collecting audit data, analyze the results to identify applications and services that rely on NTLM authentication. This step is critical for preventing service disruptions.

Use PowerShell to extract and analyze NTLM events:

# Extract NTLM authentication events from the last 7 days
$StartTime = (Get-Date).AddDays(-7)
$NTLMEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ID=4624,4625
    StartTime=$StartTime
} | Where-Object {$_.Message -match 'NTLM'}

# Group by source workstation and target
$NTLMEvents | ForEach-Object {
    $Event = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        SourceWorkstation = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'WorkstationName'} | Select-Object -ExpandProperty '#text'
        TargetUser = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
        AuthenticationPackage = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'AuthenticationPackageName'} | Select-Object -ExpandProperty '#text'
    }
} | Group-Object SourceWorkstation, TargetUser | Sort-Object Count -Descending

Check for common NTLM dependencies:

# Check for applications using NTLM
Get-WmiObject -Class Win32_Process | Where-Object {$_.CommandLine -like '*ntlm*' -or $_.CommandLine -like '*negotiate*'}

# Check IIS authentication methods
if (Get-WindowsFeature -Name IIS-WebServer | Where-Object {$_.InstallState -eq 'Installed'}) {
    Import-Module WebAdministration
    Get-WebConfiguration -Filter 'system.webServer/security/authentication/*' | Where-Object {$_.enabled -eq $true}
}

As a baseline security measure, disable the legacy NTLMv1 protocol while maintaining NTLMv2 compatibility. NTLMv1 has been removed from Windows 11 24H2 and Windows Server 2025, but this policy ensures older systems are protected.

In Group Policy Management Console, navigate to the same Security Options location and configure:

Policy: Network security: LAN Manager authentication level
Setting: Send NTLMv2 response only. Refuse LM & NTLM

This can also be configured via registry:

# Set LAN Manager authentication level to refuse LM and NTLM
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'LmCompatibilityLevel' -Value 3 -Type DWord

# Verify the setting
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'LmCompatibilityLevel'

Apply the policy and force an update:

gpupdate /force
# Restart may be required for some systems
Restart-Computer -Confirm

Test authentication after the change:

# Test Kerberos authentication
klist tgt

# Test network authentication to a domain resource
Test-NetConnection -ComputerName 'domaincontroller.domain.com' -Port 88

# Check for authentication failures
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625} -MaxEvents 10

After remediation, begin implementing NTLM restrictions progressively. Start with the most secure systems and gradually expand coverage.

Configure these policies in Security Options, applying them to different OUs based on your security tiers:

For client computers (Tier 1/2):

Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
Setting: Deny all

For member servers (Tier 1):

Network security: Restrict NTLM: Incoming NTLM traffic
Setting: Deny all domain accounts

For domain controllers (Tier 0) - Apply LAST:

Network security: Restrict NTLM: NTLM authentication in this domain
Setting: Deny for domain accounts to domain servers

Use PowerShell to configure these settings programmatically:

# Configure outgoing NTLM restrictions
$OutgoingNTLM = @{
    Path = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0'
    Name = 'RestrictSendingNTLMTraffic'
    Value = 2  # Deny all
    Type = 'DWord'
}
Set-ItemProperty @OutgoingNTLM

# Configure incoming NTLM restrictions (avoid loopback issues)
$IncomingNTLM = @{
    Path = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0'
    Name = 'RestrictReceivingNTLMTraffic'
    Value = 1  # Deny all domain accounts
    Type = 'DWord'
}
Set-ItemProperty @IncomingNTLM

# For domain controllers only - restrict domain NTLM
if ((Get-WmiObject -Class Win32_ComputerSystem).DomainRole -ge 4) {
    Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters' -Name 'RestrictNTLMInDomain' -Value 1 -Type DWord
}

# Force policy update
gpupdate /force

# Test Kerberos ticket acquisition
klist purge
klist tgt

# Monitor for NTLM restriction events (Event ID 4004, 4005)
Get-WinEvent -FilterHashtable @{LogName='System'; ID=4004,4005} -MaxEvents 20

Some legacy systems may require temporary NTLM exceptions while you work on long-term remediation. Configure these exceptions carefully to maintain security.

Create exception lists for systems that must continue using NTLM:

In Group Policy, navigate to the same Security Options location and configure:

Policy: Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication
Setting: List of specific servers (FQDN or NetBIOS names)

Example exception configuration:

legacyapp01.domain.com
backupserver.domain.com
192.168.1.100

For domain-level exceptions on domain controllers:

Policy: Network security: Restrict NTLM: Add server exceptions in this domain
Setting: List of servers that can receive NTLM from domain accounts

Configure exceptions via registry if needed:

# Create exception list for outgoing NTLM traffic
$ExceptionList = @(
    'legacyapp01.domain.com',
    'backupserver.domain.com',
    '192.168.1.100'
)

# Set the exception list (semicolon-separated)
$ExceptionString = $ExceptionList -join ';'
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name 'ClientAllowedNTLMServers' -Value $ExceptionString -Type String

# Verify the exception list
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name 'ClientAllowedNTLMServers'

Monitor exception usage:

# Check for NTLM usage to exception servers
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} | Where-Object {
    $_.Message -match 'NTLM' -and 
    ($_.Message -match 'legacyapp01' -or $_.Message -match 'backupserver')
} | Select-Object TimeCreated, Message

After implementing NTLM restrictions, thoroughly test Kerberos authentication and resolve any issues that arise.

Test Kerberos functionality across your environment:

# Clear existing tickets and request new ones
klist purge
klist tgt

# Test authentication to various services
Test-NetConnection -ComputerName 'fileserver.domain.com' -Port 445
Test-NetConnection -ComputerName 'webserver.domain.com' -Port 80
Test-NetConnection -ComputerName 'sqlserver.domain.com' -Port 1433

# Check for Kerberos tickets for specific services
klist

Common troubleshooting steps for Kerberos issues:

# Check time synchronization (critical for Kerberos)
w32tm /query /status
w32tm /resync

# Verify DNS resolution for domain controllers
nslookup _kerberos._tcp.domain.com
nslookup _ldap._tcp.domain.com

# Check SPN registration for services
setspn -L serviceaccount
setspn -Q HTTP/webserver.domain.com

# Test Kerberos authentication with specific encryption
klist -e

Monitor for authentication failures and NTLM fallback attempts:

# Check for Kerberos authentication failures
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4768,4769,4771} -MaxEvents 50 | Where-Object {$_.LevelDisplayName -eq 'Error'}

# Check for NTLM restriction events
Get-WinEvent -FilterHashtable @{LogName='System'; ID=4004,4005,4006,4007} -MaxEvents 20

# Look for authentication package downgrades
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} | Where-Object {$_.Message -match 'NTLM' -and $_.Message -notmatch 'SYSTEM'}

If you encounter persistent issues, use Microsoft's recommended escalation:

# Collect detailed authentication logs for Microsoft support
wevtutil el | findstr -i auth
wevtutil qe Security /q:"*[System[(EventID=4624 or EventID=4625)]]" /f:text /rd:true /c:100

Establish ongoing monitoring to ensure NTLM restrictions remain effective and to catch any new dependencies that might emerge.

Create a monitoring script to track NTLM usage:

# Create NTLM monitoring script
$MonitoringScript = @'
# NTLM Monitoring Script
$LogPath = "C:\Logs\NTLM-Monitor.log"
$Date = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

# Check for NTLM authentication events
$NTLMEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ID=4624,4625
    StartTime=(Get-Date).AddHours(-1)
} | Where-Object {$_.Message -match 'NTLM'}

if ($NTLMEvents) {
    "$Date - NTLM authentication detected:" | Out-File -FilePath $LogPath -Append
    $NTLMEvents | ForEach-Object {
        "  Event ID: $($_.Id), Time: $($_.TimeCreated), Message: $($_.Message.Substring(0,200))..." | Out-File -FilePath $LogPath -Append
    }
}

# Check for NTLM restriction violations
$RestrictionEvents = Get-WinEvent -FilterHashtable @{
    LogName='System'
    ID=4004,4005,4006,4007
    StartTime=(Get-Date).AddHours(-1)
} -ErrorAction SilentlyContinue

if ($RestrictionEvents) {
    "$Date - NTLM restriction events:" | Out-File -FilePath $LogPath -Append
    $RestrictionEvents | ForEach-Object {
        "  Event ID: $($_.Id), Time: $($_.TimeCreated), Level: $($_.LevelDisplayName)" | Out-File -FilePath $LogPath -Append
    }
}
'@

# Save and schedule the monitoring script
$MonitoringScript | Out-File -FilePath "C:\Scripts\NTLM-Monitor.ps1" -Encoding UTF8

# Create scheduled task for hourly monitoring
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\NTLM-Monitor.ps1"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
Register-ScheduledTask -TaskName "NTLM-Monitor" -Action $Action -Trigger $Trigger -Principal $Principal

Set up alerting for unexpected NTLM usage:

# Create alert script for critical NTLM events
$AlertScript = @'
Param([string]$EventLogName, [int]$EventID)

$Event = Get-WinEvent -FilterHashtable @{LogName=$EventLogName; ID=$EventID} -MaxEvents 1
if ($Event -and $Event.TimeCreated -gt (Get-Date).AddMinutes(-5)) {
    # Send email alert (configure SMTP settings)
    $EmailParams = @{
        To = "admin@domain.com"
        From = "ntlm-monitor@domain.com"
        Subject = "NTLM Alert: Unexpected authentication detected"
        Body = "NTLM event detected: $($Event.Message)"
        SmtpServer = "mail.domain.com"
    }
    Send-MailMessage @EmailParams
}
'@

$AlertScript | Out-File -FilePath "C:\Scripts\NTLM-Alert.ps1" -Encoding UTF8

Regular maintenance tasks:

# Weekly NTLM status report
$WeeklyReport = @'
# Generate weekly NTLM status report
$StartDate = (Get-Date).AddDays(-7)
$Report = @()

# Count NTLM events by type
$NTLMCount = (Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=$StartDate} | Where-Object {$_.Message -match 'NTLM'}).Count
$KerberosCount = (Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=$StartDate} | Where-Object {$_.Message -match 'Kerberos'}).Count

$Report += "NTLM Authentication Events: $NTLMCount"
$Report += "Kerberos Authentication Events: $KerberosCount"
$Report += "NTLM Percentage: $([math]::Round(($NTLMCount / ($NTLMCount + $KerberosCount)) * 100, 2))%"

$Report | Out-File -FilePath "C:\Reports\NTLM-Weekly-$(Get-Date -Format 'yyyy-MM-dd').txt"
'@