LM, NTLMv1 and NTLMv2: Active Directory Sign-In

Why It Matters

A machine still allowed to send an LM or NTLMv1 answer gives whoever receives it a way back to the NT hash behind it, and for a domain controller made to call out, that hash is the DC's own. Finding and switching off version 1 removes that risk.

What Happens

LM and NTLMv1 answers are DES encryptions of the server's challenge, keyed with pieces of the LM hash or the NT hash. DES keys are short, so a captured answer can be worked back to the hash it was made from, and an NT hash recovered that way works like the password.

NTLMv2 answers with an HMAC-MD5 over the server's challenge, a client challenge, a timestamp and the target information, keyed with a value made from the NT hash, the user name and the domain. A captured v2 answer can only be attacked by guessing passwords, and it names the server it was meant for.

NTLMv2 also brings a message integrity code (MIC) over the three messages, so a machine in the middle cannot strip options such as signing. It carries the target name and channel binding too, which a server can check to refuse an answer meant for elsewhere.

The LAN Manager authentication level (LmCompatibilityLevel) sets what a client sends and what domain controllers accept. Its effective default sends NTLMv2 only yet still accepts LM and NTLMv1, and level 5 also makes domain controllers refuse them.

Microsoft removed NTLMv1 starting with Windows 11 24H2 and Windows Server 2025, has deprecated every NTLM version, and plans to switch network NTLM off by default in the next major Windows Server release. Older systems can still send or accept version 1, and the enhanced NTLM events in the Microsoft-Windows-NTLM/Operational log mark it with their warning IDs (4021, 4023, 4031 and 4033).

LM, NTLMv1 and NTLMv2 Side by Side

The three answers differ in what they are keyed with, what they cover and what a captured one gives away. Read the last row first, because it is why version 1 has to go.

What Differs	LM	NTLMv1	NTLMv2
Keyed with	The LM hash, made from the password in capitals in two halves	The NT hash	A value made from the NT hash, user name and domain
Computed as	DES over the server challenge	DES over the server challenge	HMAC-MD5 over both challenges, the time and the target information
Client challenge and time	No	A client challenge only with extended session security, and no time	Yes
Names the server	No	No	Yes, in MsvAvTargetName
A captured answer exposes	The LM hash	The NT hash	Nothing directly, since it can only be attacked by guessing the password

LAN Manager Authentication Level

This one setting decides which answers clients send and which ones domain controllers accept. Check it on every machine, because a client set below 3 still sends a version 1 answer whatever the domain controllers accept.

Level	Clients Send	Domain Controllers Accept
0	LM and NTLMv1	LM, NTLMv1 and NTLMv2
1	LM and NTLMv1, with NTLMv2 session security if the server supports it	LM, NTLMv1 and NTLMv2
2	NTLMv1, with NTLMv2 session security if the server supports it	LM, NTLMv1 and NTLMv2
3 (the effective default)	NTLMv2 only	LM, NTLMv1 and NTLMv2
4	NTLMv2 only	NTLMv1 and NTLMv2, with LM refused
5	NTLMv2 only	NTLMv2 only, with LM and NTLMv1 refused

What Is Logged

Each event below names the log it is written to, the machine that writes it and the audit setting that switches it on, then what to read in it for this page.

Event and Log	Written On	Switch It On	What It Tells You
4624 `An account was successfully logged on` (opens in a new tab) Security log	The computer that was logged on to	Audit Logon	Package Name (NTLM only) shows NTLM V1 or LM for a weak answer, and anything but NTLM V2 is a client to fix.Reading Logon Events explains how to read it.
4020 and 4021 `This machine attempted to authenticate to a remote resource via NTLM` (opens in a new tab) Microsoft-Windows-NTLM/Operational log	The client that sends the NTLM sign-in (4021 flags a weaker one, such as NTLMv1)	On by default on Windows 11 24H2, Windows Server 2025 and, with October 2026 updates, Windows Server 2019 and 2022. The NTLM Enhanced Logging policy (System > NTLM) controls it	The client records which process used NTLM and why. Its warning event, 4021, flags a weaker exchange such as NTLMv1.
4022 and 4023 `A remote client is using NTLM to authenticate to this workstation` (opens in a new tab) Microsoft-Windows-NTLM/Operational log	The server the NTLM sign-in reaches (4023 flags a weaker one, such as NTLMv1)	On by default on Windows 11 24H2, Windows Server 2025 and, with October 2026 updates, Windows Server 2019 and 2022. The NTLM Enhanced Logging policy (System > NTLM) controls it	The server records the NTLM Version and MIC Status. Its warning event, 4023, flags NTLMv1 or a missing MIC.
4030 to 4033 `The DC <DC Name> processed a forwarded NTLM authentication request originating from this domain` (opens in a new tab) Microsoft-Windows-NTLM/Operational log	Domain controllers, which log 4032 and 4033 when the server is in its domain and 4030 and 4031 when only the client account is	On by default on Windows 11 24H2, Windows Server 2025 and, with October 2026 updates, Windows Server 2019 and 2022. The Log Enhanced Domain-wide NTLM Logs policy (System > Netlogon) controls it	A domain controller records each NTLM sign-in passed to it for checking, with NTLM Version. Its warning events, 4031 and 4033, flag a weaker exchange such as version 1.

Check It on a Machine

These Windows Registry keys hold the settings this page names. Open one to see where it lives and how to read it on a machine.

LM Hash Storage (NoLMHash)

Attacks That Hook in Here

These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.

NTLMv1 Downgrade
Gets a weak NTLMv1 response from a client still allowed to send one, then the NT hash.
LLMNR, NBT-NS and mDNS Poisoning
Answers the local network's name queries so victims sign in to the wrong machine.
NTLM Relay
Passes a victim's NTLM sign-in to another server and keeps the session it opens.