How do I disable NTLMv1 in my domain?
I have been given a script to disable ntlmv1 in windows.
I was advised on forums that I need to run it on domain controller as administrator.
I tried running the command it didn't work however using. Net user "user" /add /code:"NTLMv1,3;NON-PROTOCOL". I got an error invalid password or wrong password. Can some one guide me how to get rid of this? What has always worked for me (XP SP2, domain controllers) is simply opening a remote PowerShell session on the DC in question using PsExec v3. This lets you manage users at the OS level on the target machine without having to use the net user command which you don't seem to have run yet. (And as noted in one of the comments, adding the 3rd bit as NOPOL may not actually disable Kerberos auth, even if its in the registry)
PsExec.exe v3.0.ps1"
Run that first and then whatever command you wish to issue. Here is an example of ps1 file that uses PsExec : (gci -path "c:temp") ps1. This runs a simple Gci (Get-ChildItem) against c:temp and saves all the results in a text file called userauthtest.ps1 which runs when run remotely.
It includes the ability to disable NTLM and the ability to get the NT password in plaintext by changing a single string in the text file with a simple string replace. Also included is the ability to disable the default logon in AD for that user, as well as the ability to disable password resets using the set-password cmdlet.
Is NTLM still enabled?
Related Answers
Which is more secure NTLM or Kerberos?
We're using NTLM over SSL (HTTPS) for our web server and authenticating against Active...
How do you check if NTLM is enabled on a server?
I have a Windows Server 2024 R2 domain controller that...
How do I restrict NTLM settings?
NTLM or Kerberos authentication. The choice is yours. I pre...