I wish to perform a scenario which will produce network traffic of NTLM1 or NTLM2.

I Tried several setups but could not produce that traffic. I guess windows tries to avoid that kind of authentication these days.

Which scenario can produce NTLM traffic?
Can I use any Windows version?
Do I need to have a domain controller?
Do I need to set some policy in the policy manager of the domain controller?

  • Unfortunately, this is not a security question but a pure Windows question. – schroeder Apr 29 '18 at 12:00
  • Microsoft NTLM (Windows) "Interactive NTLM authentication over a network typically involves two systems: a client system, where the user is requesting authentication, and a domain controller, where information related to the user's password is kept. Noninteractive authentication, which may be required to permit an already logged-on user to access a resource such as a server application, typically involves three systems: a client, a server, and a domain controller" – DavidPostill Apr 30 '18 at 19:29
  • "Do I need to have a domain controller?" Yes. – DavidPostill Apr 30 '18 at 19:29
  • "Can I use any Windows version?" You can use any Windows version that supporst NTLM. – DavidPostill Apr 30 '18 at 19:31
  • 1
    That's not right; all non-domain connections use NTLM (that's the only thing they can use) and very few domain connections do (most use Kerberos). – user1686 May 1 '18 at 19:31

I found that I can use windows xp to create the scenario.
There might be other ways but I am just interested in the simplest one.

Create a lab with two windows xp machines. Have the machines on the same network. Have one windows xp access the other windows xp's share (see attached image) will produce ntlm traffic.

enter image description here

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.