Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000202

NTLM auditing not enabled in Active Directory

Medium
Active Directory
Credential Access Defense Evasion
v5

Signature Identity

CTD-000202
Threat ID
5
Version
IOE
Indicator Type

Threat Description

NTLM is a legacy authentication protocol that is susceptible to credential relay, brute-force attacks, and lateral movement. If NTLM auditing is not enabled, administrators may not be able to identify systems, applications, or accounts that still rely on NTLM authentication.

A threat actor can exploit NTLM-dependent systems to relay credentials, access resources, and move laterally across the environment. Enabling NTLM auditing helps organizations detect NTLM usage before restricting or blocking NTLM authentication.

MITRE ATT&CK: Attack Tactics

Credential Access Defense Evasion

D3FEND: Defend Tactics

Credential Hardening

Remediation

To enable NTLM auditing, use the Group Policy Management Console:

  1. Open Group Policy Management Console.
  2. Edit the Default Domain Controllers Policy or another GPO linked to the Domain Controllers OU.
  3. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
  4. Configure the following policies:
    • Set Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Audit all.
    • Set Network security: Restrict NTLM: Audit NTLM authentication in this domain to Enable all.
    • Set Network security: Restrict NTLM: Audit Incoming NTLM Traffic to Enable auditing for all accounts.
  5. Wait for Group Policy to refresh, or apply the GPO immediately by running the following command: gpupdate /force

    Important: Before validating the result, ensure that another policy is not overriding the configured GPO. If multiple GPOs are linked to the Domain Controllers OU or at the domain level, another GPO may configure the same NTLM settings and overwrite the expected values.
    Check the GPO link order, confirm that the GPO is enabled, and verify security filtering. To review the effective policy on the domain controller, run:

    gpresult /h C:Tempgpresult.html /scope computer /f
  6. Review NTLM audit events to identify systems, applications, or accounts that still use NTLM.

Note: Enable auditing before restricting or blocking NTLM authentication. Restricting NTLM without reviewing audit results may disrupt applications or services that still depend on NTLM.

Frequently Asked Questions

What does NTLM auditing not enabled in Active Directory mean?

NTLM auditing not enabled in Active Directory means that the domain is not collecting audit records for NTLM authentication events, making it challenging to identify systems or accounts still relying on NTLM protocol. This protocol is susceptible to credential relay and lateral movement attacks due to its legacy design.

NTLM auditing not enabled in Active Directory is rated medium severity because it allows attackers to exploit the inherent weaknesses of the NTLM protocol without being detected. Without NTLM auditing, administrators may remain unaware of systems or accounts still using NTLM authentication, making it easier for threat actors to relay credentials and move laterally across the environment.

When NTLM auditing is disabled in Active Directory, an attacker can exploit systems or accounts still using NTLM authentication by relaying credentials to access resources. This allows them to move laterally across the environment undetected, increasing their chances of escalating privileges and gaining unauthorized access to sensitive data.

Cayosoft Guardian detects NTLM auditing not enabled in Active Directory by continuously monitoring the configuration of NTLM auditing across the Active Directory environment domain. When it finds that NTLM auditing is disabled, Guardian flags it as a security issue so administrators are aware of the potential risk.

Cayosoft Guardian helps reduce the risk of NTLM auditing not enabled in Active Directory by alerting administrators to enable NTLM auditing. This allows organizations to detect and restrict NTLM usage, preventing attackers from exploiting legacy protocol weaknesses. Guardian also supports ongoing monitoring so that if NTLM auditing is disabled later, the change is caught quickly.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Infrastructure
Attack Tactics
Credential Access Defense Evasion
Defend Tactics
Credential Hardening
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical