NTLM-AnalyzerNTLM status report
28.1 % of all logons still go through NTLM.
Trend
NTLM share per week - the goal is the zero line.
Progress
The dashboard's work list, and machines that can switch NTLM off.
Ready to switch off
Risks and visibility
What needs attention first - and where the picture is incomplete.
25 NTLMv1 logons from 6 accounts, mostly svc_scan, mfp_service, d.fischer and 3 more. NTLMv1 can be cracked and should be switched off first.
4 logons use NTLMv1-derived credentials. They will break by themselves with the October 2026 change.
Possible password spraying: UNKNOWN-PC failed with 8 accounts. Find the machine and the cause.
The picture is incomplete: 2 machines with auditing off, 36 machines use NTLM without an agent.
26 sessions without MIC protection or channel binding - open to NTLM relay.
Next steps
Derived from the data, most important first.
- Switch off NTLMv1 for svc_scan, mfp_service, d.fischer and 3 more. Set LmCompatibilityLevel 5 on the machines behind it and replace or isolate devices that can only do NTLMv1.
- Before October 2026 move the 2 accounts with NTLMv1-derived credentials - otherwise they fail with the change.
- Check for password spraying: UNKNOWN-PC failed with 8 accounts.
- Fix service names (SPN): 4 are missing or registered wrongly, first cifs/nas01, http/intranet, cifs/archive01 and 1 more - 79 NTLM connections behind them. The setspn commands are in the dashboard.
- Tackle the most common cause: Target name could not be resolved by Kerberos (14×). Check the SPN: missing, wrong or duplicated (setspn -X finds duplicates).
- Set "Restrict NTLM: Deny" on 2 machines that have not used NTLM for 30 days: SRV-PRINT, WKS-0107.
What is left
The largest items by number of logons in the period.
| Program → target | Logons |
|---|---|
| msedge.exeopen→ HTTP/intranet | 23 |
| explorer.exein progress→ cifs/fs01.demo.nopcap.net | 17 |
| svchost.exeopen→ ldap/dc01.demo.nopcap.net | 16 |
| Systemin progress→ cifs/fs01.demo.nopcap.net | 12 |
| Veeam.Backup.Service.exein progress→ cifs/nas01 | 12 |
| EXCEL.EXEopen→ cifs/fs01.demo.nopcap.net | 9 |
| WINWORD.EXEopen→ cifs/fs01.demo.nopcap.net | 6 |
| wsmprovhost.exein progress→ HOST/app03 | 6 |
| explorer.exeopen→ nas01 | 4 |
| java.exeopen→ HTTP/erp-test | 3 |
| robocopy.exeopen→ cifs/archive01 | 3 |
| Account | Logons |
|---|---|
| svc_backupfrom 8 machines to 8 servers | 27 |
| k.lorenzfrom 11 machines to 7 servers | 26 |
| m.beckerfrom 15 machines to 10 servers | 26 |
| svc_sqlfrom 11 machines to 9 servers | 24 |
| j.schulzfrom 22 machines to 9 servers | 23 |
| p.neumannfrom 14 machines to 8 servers | 21 |
| t.hoffmannNTLMv1from 11 machines to 9 servers | 20 |
| a.kleinfrom 10 machines to 7 servers | 18 |
| administratorfrom 9 machines to 7 servers | 16 |
| svc_monitorfrom 9 machines to 9 servers | 17 |
| svc_webfrom 8 machines to 8 servers | 17 |
| d.fischerfrom 12 machines to 9 servers | 16 |
| s.wagnerfrom 8 machines to 7 servers | 14 |
| svc_scanNTLMv1from 4 machines to 2 servers | 12 |
| mfp_serviceNTLMv1from 2 machines to 2 servers | 8 |