NTLMv1 Mitigation

[sh_xfab]

Hi,Our company in plan to mitigate NTLMv1 and I still in the process of test the thing out to see what the behaviors are by changing the LAN manager authentication level to "5-Send NTLMv2 response only\refuse LM & NTLM" at client side first.Environment:Client (W2K) ----------- ADDC(WinSvr2016)Client:LAN manager authentication level to "5-Send NTLMv2 response only\refuse LM & NTLM"ADDC:LAN manager authentication level to "1-Send LM & NTLM response"Security event log from ADDC still showing NTLMv1, is the normal behavior?

Continue reading...