Overview of NTLM auditing enhancements in Windows 11, version 24H2 and Windows Server 2025

In this article:

• Introduction

• Purpose of NTLM auditing changes

• NTLM auditing logs

• Group Policy management

• Audit levels

• Client logs

• Server logs

• Domain controller logs

• Relationship between new and existing NTLM events

• Deploment information

Introduction

This article provides an overview of upcoming changes to NT LAN Manager (NTLM) auditing functionality in Windows 11, version 24H2 and Windows Server 2025. These enhancements are designed to increase visibility into NTLM authentication activity, enabling administrators to determine the identity of users, the rationale for NTLM usage, and the specific locations where NTLM is employed within an environment. Enhanced auditing supports improved security monitoring and the identification of legacy authentication dependencies.

Purpose of NTLM auditing changes

NTLM authentication continues to be present in various enterprise scenarios, often due to legacy applications and configurations. With the announcement of NTLM deprecation and future disablement (see the Windows IT Blog The evolution of Windows authentication) the updated auditing features are intended to assist administrators in identifying NTLM usage, understanding usage patterns, and detecting potential security risks, including the use of NT LAN Manager version 1 (NTLMv1).

NTLM auditing logs

Windows 11, version 24H2 and Windows Server 2025 introduce new NTLM audit logging capabilities for clients, servers, and domain controllers. Each component generates logs that provide detailed information regarding NTLM authentication events. These logs can be found in Event Viewer under Applications and Services Logs > Microsoft > Windows > NTLM > Operational.

As compared to existing NTLM auditing logs, the new enhanced auditing changes allow administrators to answer the Who, the Why, and the Where:

• Who is using NTLM, including the account and process on the machine.

• Why NTLM authentication was chosen, instead of modern authentication protocols like Kerberos.

• Where the NTLM authentication is happening, including both the machine name and the machine IP.

The enhanced NTLM auditing also provides information about NTLMv1 usage for clients and servers, as well as NTLMv1 usage domain-wide logged by the domain controller. ​​​​​​​

Group Policy management

The new NTLM auditing features are configurable through updated Group Policy settings. Administrators can use these policies to specify which NTLM authentication events are audited and to manage auditing behavior across clients, servers, and domain controllers as appropriate for their environment.

By default, the events are enabled.

• For client and server logging, the events are controlled through the “NTLM Enhanced Logging” policy under Administrative Templates > System > NTLM.
  
  

• For domain-wide logging on the domain controller, the events are controlled through the “Log Enhanced Domain-wide NTLM Logs” policy under Administrative Templates > System > Netlogon.
  
  ​​​​​​​ ​​​​​​​

Audit levels

Each NTLM audit log is split into two different Event IDs with the same information that only differ by event level:

• Information: Indicates standard NTLM events, such as NT LAN Manager version 2 (NTLMv2) authentication, where no reduction in security is detected.

• Warning: Indicates a downgrade of NTLM security, such as the use of NTLMv1. These events highlight insecure authentication. An event might be marked as a “Warning” for instances such as the following:

  • NTLMv1 usage detected by either the client, server, or domain controller.

  • Enhanced Protection for Authentication is marked as not supported or insecure (for more information, see KB5021989: Extended Protection for Authentication).

  • Certain NTLM security features, such as the message integrity check (MIC), are not used.

Client logs

New audit logs record outgoing NTLM authentication attempts. These logs supply details about the applications or services initiating NTLM connections, along with relevant metadata for each authentication request.

Client logging has a unique field, Usage Id/Reason, which highlights why NTLM authentication was used.

Server logs

New audit logs record incoming NTLM authentication attempts. These logs supply similar details about the NTLM authentication as the client logs, as well as report whether the NTLM authentication succeeded or not.

Domain controller logs

Domain controllers benefit from enhanced NTLM auditing, with new logs that capture both successful and unsuccessful NTLM authentication attempts for the entire domain. These logs support identification of cross-domain NTLM usage and alert administrators to potential downgrades in authentication security, such as NTLMv1 authentication.

Different domain controller logs are created depending on the following scenarios:

Relationship between new and existing NTLM events

The new NTLM events are an enhancement over the existing NTLM logs, such as Network security: Restrict NTLM Audit NTLM authentication in this domain. The enhanced NTLM auditing changes do not affect the current NTLM logs; if the current NTLM auditing logs are enabled, they will continue to be logged.

Deployment information

In accordance with Microsoft controlled feature rollout (CFR), the changes will first gradually rollout to Windows 11, version 24H2 machines, followed later by Windows Server 2025 machines including domain controllers.

A gradual rollout distributes a release update over a period of time, rather than all at once. This means that users receive the updates at different times, and it might not be immediately available to all users.