Thread by @BlackMatter23

I've recently consulted one company about #NTLM-family protocols. They had various monitoring & hardening questions.
So, I decided to post some of their questions with the answers:
1. LM protocol is old and weak - how can we monitor its usage?

1. In general, you can monitor it using "Package Name" field of 4624/4625 events. But, keep in mind that LM is disabled by default starting with Win7/WS2008R2.
So, if you still have some old machines using it, LM is definitely not the biggest problem for you😵

2. Can we block NTLM protocols on our Firewall?
No. NTLM-family don't have default transport protocol, so there is no default associated ports with these protocols. Most common transports are SMB, HTTP and SMTP.
Other mechanisms exist for disabling them, see below.

3. We want to use NTLMv2 because of stronger hash.
There is no NTLMv2 hash. NTLMv2 uses NTLM hash. Like LM, NTLM is disabled by default starting with Win7/WS2008R2. But there may be some legacy services/devices which use it, so be careful before disabling NTLM.

3. Use "Network Security: Restrict NTLM" group policy and find all such devices using EIDs 8001-8003.
Again, 4624/4625 events may also be useful here.

P.S After disabling NTLM you can go further and disable NTLMv2. Yes, in many orgs this is just impossible, but NTLMv2 is still much behind Kerberos in terms of security.
Microsoft helps us here, find out how in this article:
woshub.com/disable-ntlm-a…