Home / server / Questions / 1085134
Accepted
bahrep
Asked: 2021-12-02 15:37:42 +0800 CST

Not defined state of the `Network security: Restrict NTLM: NTLM authentication in this domain` GPO

  • 772

Is NTLM by default disabled on domain controllers with Windows Server 2019?

My current tests show that the GPO Network security: Restrict NTLM: NTLM authentication in this domain does not work as documented. When this GPO is Not defined, NTLM does not work, and I see errors in Windows Security log:

Status: 0x80090302
Sub Status: 0xC0000418

Status 0xC0000418 translates to STATUS_NTLM_BLOCKED (The authentication failed because NTLM was blocked).

However, if I change GPO to Disable, NTLM works again.

The documentation says that when "Not defined" "The domain controller will allow all NTLM authentication requests in the domain where the policy is deployed.". So I was assuming that I don't need to change group policies to enable NTLM.

OS Name Microsoft Windows Server 2019 Standard

Version 10.0.17763 Build 17763

windows group-policy windows-server-2019 ntlm

1 Answers

  1. Best Answer

    I overlooked that the server computers had a Local Security Policy that disabled NTLM. NTLM works again after removing this policy.

    • 0