Microsoft includes NTML or NT LAN Manager Protocol in Windows NT for basic authentication purposes – and has tried enhancing its security by introducing Kerberos authentication. However, NTML Protocol is still used in Windows Domain Networks. In this article, we are going to see how to disable NTML Authentication in Windows Domain.
Disable NTML Authentication in Windows Domain
There can be multiple reasons why you may want to disable NTML Authentication in Windows Domain. Some of the most common reasons are:
- NTML is not secure and offers weak encryption.
- In the case of NTML, your password hash will be stored in LSA Service. It can be easily extracted by an attacker.
- It is vulnerable to Data Interception attacks as there is a lack of mutual authentication between the client and the server.
After knowing the reasons to disable NTML Authentication, let’s see the reasons to disable it.
These are the ways by which we are going to disable NTML Authentication in Windows Domain.
- By Local Group Policy Editor
- By Registry Editor
Let us talk about them in detail.
1] By Group Policy Editor
Before disabling NTML, we need to make sure that you are not using its most unprotected protocol i.e; NTMLv1 or NTML Version 1. This can make your domain vulnerable to attackers. Once you are done with that, follow the following method to disable NTML Authentication in Windows Domain by Group Policy Editor.
To do that, open Local Group Policy Editor from the Start menu. Go to the following location.
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Now, double-click on Network Security: LAN Manager authentication level. Select Sent NTMLv2 response only. Refuse LM & NTML from the “Local Security Settings” tab.
Click Apply > Ok and NTML authentication will be disabled on your domain.
2] By Registry Editor
If you don’t have Group Policy Editor, you can disable NTML from the Registry Editor. You can easily do that, with the help of some simple solutions.
Launch Registry Editor from the Start Menu and navigate to the following location.
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lsa
Now, right-click on Lsa and select New > DWORD (32-bit) Value. Name it “LmCompatibilityLevel” and set Value data to 5. 5 because it corresponds to “Sent NTMLv2 response only. Refuse LM & NTML”.
This way you will be able to disable NTML by Registry Editor.
UPDATE: All versions of NTLM, including LANMAN, NTLMv1, and NTLMv2, are no longer under active feature development and are deprecated. The use of NTLM will continue to work in the next release of Windows Server and the next annual release of Windows. Calls to NTLM should be replaced by calls to Negotiate, which will try to authenticate with Kerberos and only fall back to NTLM when necessary.
Read Next: Why and How to disable SMB1 on Windows.
