0

I already started changing my applications that use NTLM v1 in the authentication for NTLM v2.

I still have several event IDs in my DCs that show sessiom NULL with anonymous accounts. after troubleshooting I found that the sessions are done by remote Windows services in my LAN particularly Windows 2008 and less.

The authentication package that is used in those sessions is NTLM V1 like event ID 4624 (Microsoft windows Security Auditing)

Is it possible to force the NTLM V2 rather than NTLM V1 for those anonymous authentication used by Windows services?

2 Answers2

1

I think if you look at this answered question, that you will see how to disable NTLMv1 connections and that should force the connection to be over NTLMv2

Community
  • 1
Rowan Hawkins
  • 590
  • 2
  • 18
0

Here are all the possible settings and the ramifications of each. https://markgamache.blogspot.com/2013/01/ntlm-challenge-response-is-100-broken.html

markgamache
  • 195
  • 4