๐ Secure Bits ๐ก
Did you know, ๐ก๐ง๐๐ ๐๐ฎ๐ ๐ฑ๐ฒ๐ฝ๐ฟ๐ฒ๐ฐ๐ฎ๐๐ฒ๐ฑ ๐ฏ๐ ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐ถ๐ป ๐ฎ๐ฌ๐ฎ๐ฐ ?
I know it is not a simple task for companies to get rid of NTLM in their environments, especially if you have hundreds or thousands of assets. I have assessed dozens of companies, so I have been there.
Dang, it is even hard to convince Windows OS to stop using NTLM. But that is not the point of this post.
There are GPOs that help you get rid of NTLM in your environment. As you can see below, you can completely disable NTLM in your Active Directory, but more importantly, you can AUDIT NTLM traffic before you do so.
I recommend starting to get rid of NTLM step-by-step. Audit the usage and disable it where you know it is safe.
Here is what you can do with GPOs:
– Deny all incoming NTLM traffic
– Deny all outgoing NTLM traffic
– Add servers to exception, so they can still use NTLM
– ๐๐๐ฑ๐ถ๐ ๐ก๐ง๐๐ ๐๐ฟ๐ฎ๐ณ๐ณ๐ถ๐ฐ
