A. By default, an AD domain supports LAN Manager, NT LAN Manager (NTLM), NTLMv2, and Kerberos, although it will always attempt to use the most secure shared authentication method. For example, a Windows NT 4.0 Service Pack 6 (SP6) machine will use NTLMv2 when talking to an AD domain controller (DC) because, although AD understands Kerberos, the client supports only NTLMv2 at best.
To restrict the protocols that DCs and clients support, you can modify the Network Security LAN Manager Authentication Level policy by performing these steps:
- 1. Use Group Policy Editor (GPE) to open the Group Policy Object (GPO) you want to modify. You can create a policy that applies to the entire domain (by linking the GPO at a domain level) or applies only to DCs (by linking to the Domain Controllers organizational unit--OU).
- Navigate to Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options.
- 3. Double-click the "Network security: LAN Manager authentication level" policy.
- 4. Select "Define this policy setting" and from the drop-down menu select the desired level, as the figure shows. Click OK.
- 5. Close the GPO.
When the policy refreshes, the level of LAN Manager and NTLM support will change for the clients and servers to which you applied the policy. Table 1 shows the various policy options and their effects. Note that the policy affects clients and DCs in different ways.
If your environment consists of only Windows 2000 and later machines, you should configure the "Send NTLMv2 response only\refuse LM & NTLM" option, which will allow only NTLMv2 authentication (although Kerberos will still be the preferred authentication method).
