A: Windows 7 and Windows Server 2008 R2 include new Group Policy settings that let you audit, analyze, and restrict NTLM authentication use in your Windows environment. Microsoft introduced three security policy settings you can use for auditing NTLM traffic. The settings are stored in the following Group Policy Object (GPO) container: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options. They're called:
- Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
- Network security: Restrict NTLM: Audit NTLM authentication in this domain
- Network security: Restrict NTLM: Audit Incoming NTLM Traffic
You should enable the Restrict NTLM: Audit NTLM authentication in this domain setting only on your Windows Server 2008 R2 domain controllers (DCs). To enable it, choose the Enable all option in the Microsoft Management Console (MMC) GPO Editor snap-in.
You can use the other two settings -- Restrict NTLM: Outgoing NTLM traffic to remote servers and Restrict NTLM: Audit Incoming NTLM Traffic -- for auditing NTLM authentication traffic on all Windows 7 and Windows Server 2008 R2 computers.
To enable auditing for the first setting, choose the Audit all option, as Figure 1 shows; to enable auditing for the latter setting, choose
the Enable auditing for all accounts option.
Figure 1: Enabling the Restrict NTLM: Outgoing NTLM traffic to remote servers setting
NTLM audit events are written to the following event log path: \Applications and Services Logs\Microsoft\Windows\NTLM\Operational. Note that this log isn't visible by default in the MMC Event Viewer snap-in. To view this log, you must enable the Show Analytic and Debug Logs option in the Event Viewer's View menu.
Whenever the NTLM protocol is used for authentication, an event with ID 8004 shows up in a Windows Server 2008 R2 DC's log, an event with ID 8003 shows
up in a Windows Server 2008 R2 member server's log, and an event with ID 8001 appears in a Windows 7 client's log, as Figure 2 illustrates
Figure 2: Event ID 8001, indicating NTLM protocol authentication, appearing in a Windows 7 client log (Click image for larger view)
