Tips Before Disabling NTLMv1
Asked by
TechieKnight91
I'm about to disable NTLMv1 across my systems, but I want to make sure everything's ready before I do. Here's my setup: all PCs are on Windows 10 or 11, and the servers range from 2016 to 2025. I've had auditing for NTLMv1 turned on for a week now, and I've been running PowerShell scripts daily to check for any NTLMv1 events, but so far, I haven't found any. Is there anything else I should check before I go ahead with this change?
Answers
You’re all set, just go for it! No worries!
Reply to this answer
I'm also planning to do this. Out of curiosity, did you notice any Anonymous Logon events? If so, are you just ignoring those?
Reply to this answer
You’ve already audited NTLM usage, which is great! If you haven’t seen any hits after having auditing for about a month, I’d say you’re safe to proceed. I've had NTLMv1 disabled for years now and even disabled NTLMv2 for client outbound connections last year—everything’s been running smoothly without any hiccups.
Reply to this answer
I thought I was the only one who did this four years ago!
Reply to this answer
Add your answer
Answers are reviewed before publication.
TechieKnight91: I'm not auditing for Anonymous logons, should I be?