NTLM-AnalyzerNTLM status report
27.5 % of all logons still go through NTLM.
Trend
NTLM share per week - the goal is the zero line.
Progress
The dashboard's work list, and machines that can switch NTLM off.
Ready to switch off
Risks and visibility
What needs attention first - and where the picture is incomplete.
85 NTLMv1 logons from 9 accounts, mostly svc_scan, mfp_service, t.hoffmann and 6 more. NTLMv1 can be cracked and should be switched off first.
12 logons use NTLMv1-derived credentials. They will break by themselves with the October 2026 change.
Possible password spraying: UNKNOWN-PC failed with 8 accounts. Find the machine and the cause.
The picture is incomplete: 2 machines with auditing off, 135 machines use NTLM without an agent.
108 sessions without MIC protection or channel binding - open to NTLM relay.
Next steps
Derived from the data, most important first.
- Switch off NTLMv1 for svc_scan, mfp_service, t.hoffmann and 6 more. Set LmCompatibilityLevel 5 on the machines behind it and replace or isolate devices that can only do NTLMv1.
- Before October 2026 move the 2 accounts with NTLMv1-derived credentials - otherwise they fail with the change.
- Check for password spraying: UNKNOWN-PC failed with 8 accounts.
- Fix service names (SPN): 4 are missing or registered wrongly, first cifs/nas01, http/intranet, cifs/archive01 and 1 more - 330 NTLM connections behind them. The setspn commands are in the dashboard.
- Tackle the most common cause: Target name could not be resolved by Kerberos (55×). Check the SPN: missing, wrong or duplicated (setspn -X finds duplicates).
- Set "Restrict NTLM: Deny" on 2 machines that have not used NTLM for 30 days: SRV-PRINT, WKS-0107.
What is left
The largest items by number of logons in the period.
| Program → target | Logons |
|---|---|
| Systemin progress→ cifs/fs01.demo.nopcap.net | 148 |
| svchost.exeopen→ ldap/dc01.demo.nopcap.net | 76 |
| explorer.exein progress→ cifs/fs01.demo.nopcap.net | 65 |
| msedge.exeopen→ HTTP/intranet | 62 |
| Veeam.Backup.Service.exein progress→ cifs/nas01 | 43 |
| EXCEL.EXEopen→ cifs/fs01.demo.nopcap.net | 25 |
| wsmprovhost.exein progress→ HOST/app03 | 25 |
| robocopy.exeopen→ cifs/archive01 | 24 |
| WINWORD.EXEopen→ cifs/fs01.demo.nopcap.net | 21 |
| java.exeopen→ HTTP/erp-test | 19 |
| explorer.exeopen→ nas01 | 12 |
| excel.exeopen→ cifs/archive01 | 1 |
| spoolsv.exeopen→ cifs/fs01 | 1 |
| Account | Logons |
|---|---|
| svc_backupfrom 32 machines to 10 servers | 116 |
| t.hoffmannNTLMv1from 40 machines to 10 servers | 93 |
| svc_sqlfrom 41 machines to 10 servers | 90 |
| m.beckerfrom 48 machines to 10 servers | 87 |
| administratorfrom 41 machines to 10 servers | 84 |
| j.schulzfrom 44 machines to 10 servers | 85 |
| a.kleinfrom 48 machines to 10 servers | 83 |
| p.neumannfrom 42 machines to 9 servers | 83 |
| d.fischerfrom 41 machines to 10 servers | 82 |
| k.lorenzfrom 37 machines to 10 servers | 78 |
| s.wagnerfrom 35 machines to 10 servers | 75 |
| svc_monitorfrom 20 machines to 10 servers | 75 |
| svc_webfrom 34 machines to 9 servers | 72 |
| svc_scanNTLMv1from 4 machines to 3 servers | 40 |
| mfp_serviceNTLMv1from 3 machines to 2 servers | 30 |