HI all,

sorry for my englisch . If I select Logon network security ,  Password authentication(NTLM) , which version of NTLM is used ? NTLM v1 or v2 ?

Hi,

We can determine if the NTLM audit information in the event log pertains to NTLM v1 or NTLM v2. To do this, you can follow these steps:

1. Open Event Viewer on the target computer.

2. Under Windows Logs, select the Security log.

3. For the list of security events, visually inspect the log to verify that Logon events are recorded.

4. To search the list of events in the log, use Find with the phrase Authentication Package.

5. For each event located, on the General tab, view the Authentication Package information under Detailed Authentication Information. If the package is NTLM, then the Package Name will state the version.

For detailed information, please refer to this link:

http://technet.microsoft.com/en-us/library/jj865682(v=ws.10).aspx

If still no luck, we may also try capturing the network traffic to find the version information. See:

http://blogs.msdn.com/b/openspecification/archive/2010/05/03/ntlm-v1-no-excuse-me-ntlm-v2-oh-no-you-were-right-it-s-v1.aspx

Hope this helps.

Regards,

Steve Fan

Forum Support