Would you like to learn how to configure a group policy to audit the NTLM authentication success and failure? In this tutorial, we will show you how to configure the NTLM authentication audit feature using a GPO.
• Windows 2012 R2
• Windows 2016
• Windows 2019
• Windows 2022
• Windows 10
• Windows 11
Equipment list
Here you can find the list of equipment used to create this tutorial.
This link will also show the software list used to create this tutorial.
Windows Related Tutorial:
On this page, we offer quick access to a list of tutorials related to Windows.
Tutorial GPO – Audit the NTLM authentication
On the domain controller, open the group policy management tool.
Edit the default domain policy.
On the group policy editor screen, expand the Computer configuration folder and locate the following item.
Access the folder named Security options.
Edit the configuration item named Network security: Restrict NTLM: Audit Incoming NTLM Traffic.
Enable the options to audit for all accounts.
Edit the configuration item named Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers.
Enable the options to audit all.
To save the group policy configuration, you need to close the Group Policy editor.
Edit the default domain controllers policy.
On the group policy editor screen, expand the Computer configuration folder and locate the following item.
Access the folder named Security options.
Edit the configuration item named Network security: Restrict NTLM: Audit NTLM authentication in this domain.
Select the option Enable all.
To save the group policy configuration, you need to close the Group Policy editor.
Congratulations! You have finished the GPO creation.
Tutorial GPO – Audit NTLM logon events
After applying the GPO you need to wait for 10 or 20 minutes.
During this time the GPO will be replicated to other domain controllers.
On a remote computer, start an elevated Powershell command-line.
Verify the list of NTLM events that will be logged.
Here is the command output.
List NTLM logon events.
Here is the command output.
List specific NTLM events.
Get details from the last NTLM event.
Here is the command output.
In our example, we configured a GPO to audit NTLM success and failure events.
