Is Kerberos enabled by default for Windows Server 2016 AD domain?

I'm new to Windows AD, so I've set up a virtual environment consisting of a Windows 2016 server and a few Windows 10 machines.

I wonder if the Windows AD use NTLM or Kerberos for network authentication (default settings)?

How can I check this? - and can both authentication mechanisms be used simultaneously?


According to my knowledge, the Kerberos protocol is used for network authentication by default for windows server 2016. But the NTLM is still supported. I would suggest you to see the following article to learn for more information. For your reference: https://docs.microsoft.com/en-us/windows/desktop/secauthn/microsoft-ntlm Please refer to images to check which protocol is used by windows AD. image1image2image3 The Location is :server manager-tools-event viewer-windows logs-security. Search for the event log which event ID is 4624 and you can see the detailed anthentication information. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624 Also, we could use group policy to audit NTLM authentication logon attempts. Here is the location: computer configuration- policies-windows settings-security settings-local policies-security options-network security: restrict NTLM: Audit NTLM authentication in this domain. image4 image5 This policy will log events for NTLM pass-through authentication requests from its servers and for its accounts so that you can check it if the NTLM is used. Best Regards, Roger

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.