Audit NTLM Usage Before Restricting or Disabling It

NTLM is a legacy authentication protocol vulnerable to relay attacks, pass-the-hash, and offline cracking. Many environments still depend on it for legacy applications, printers, or scripts, so disabling it blindly can break production systems. NTLM auditing lets you discover where and how NTLM is still used before restricting or eliminating it.

Steps to implement

• Enable NTLM audit logging via GPO: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options, setting "Network security: Restrict NTLM: Audit NTLM authentication in this domain" and "Audit Incoming NTLM Traffic" to enabled.
• Deploy the audit GPO to domain controllers and member servers to capture NTLM authentication events domain-wide.
• Collect and review Event ID 8004 (NTLM authentication in domain) and Event ID 4624/4776 logs to identify source devices, accounts, and target applications using NTLM.
• Forward NTLM audit events to your SIEM for centralized analysis and trend reporting over a 30-60 day baseline period.
• Identify and prioritize remediation for legacy applications or devices that cannot support Kerberos, planning upgrades or exceptions.
• Once usage is understood, progressively apply NTLM restriction policies (deny/allow lists) and move toward Kerberos-only authentication where feasible.