0

I'm trying to disable NTLM (for security reason) on a new domain.

I'm activating the Network security: Restrict NTLM: Incoming NTLM traffic, Network security: Restrict NTLM: NTLM authentication in this domain and Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers, to deny all incomming or ougoing NTLM from/to clients/servers.

settings

But then, when try to connect via RDP, I'm getting this error message :

error message

I've check the providede link and both my win 10 client and my windows servers 2019 are completly updated and their tspkg.dll are in an upper version than the one with the patch for the credssp/oracle remediation CVE.

I've even tried it on a brand new lab domain in a local VM : same thing.

I've also tried to downgrade the auth to "vulnerable" via gpedit, to no avail.

Am I missing a setting somewhere ?

ref : https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic

ref : https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain

Improve this question
5
  • Does this happen when you try to rdp with both the DNS name and the IP address? I think you also need to force the client you are RDP'ing from to force kerberos and not use NTLM as well. So if the server policy is restricted and the client is still trying to connect via NTLM, that may be the reason you are having this problem. Curious to know if both IP and DNS connections give the same result. I ran into an issue a few months back but didn't document it but it was something along those lines if I recall correctly. In my case, I had to open it back up due to NTLM being needed for processes.
    – Vomit IT - Chunky Mess Style
    Sep 25, 2019 at 14:59
  • Indeed, the issue seem to be only when connecting via IP. When connection via DNS, it's fine. Do you remember if you found a workaround to make it work by ip too ?
    – Remy Grandin
    Sep 27, 2019 at 9:50
  • Remy - Check out the social.technet.microsoft.com/Forums/en-US/… and the answer that talks about additional NTLM related settings. I think but I don't recall 100% that some of these settings are what I had to adjust but I ended up just allowing the NTLM on the server I locked down because of too many problems and it being needed for specific functionality to work properly.
    – Vomit IT - Chunky Mess Style
    Sep 27, 2019 at 11:19
  • Furthermore, I recall reading over this docs.microsoft.com/en-us/windows/win32/secauthn/… but not sure if I ever dug into it much more than that. Check the event viewer for specific logs related to NTLM in system log I think and look those over as that's what helped me. I think there may be a specific NTLM or kerberos log within event logs too but there was another event viewer error I was looking up and seeing when this happened in my case. Let me know if any of that helps, and look forward to hearing back.
    – Vomit IT - Chunky Mess Style
    Sep 27, 2019 at 11:22
  • Lastly, one for good read for you as FYI as this looks familiar too for what I read when I was dealing with the issue.... rootusers.com/implement-ntlm-blocking-in-windows-server-2016 Okay, I'm gonna stop commenting you on it so much now but good luck with getting it worked out and resolved.
    – Vomit IT - Chunky Mess Style
    Sep 27, 2019 at 11:27

4 Answers 4

Reset to default
1

For me, when the Default Domain Policy has Restrict NTLM "Deny for domain servers" active and servers have NLA checked, it seems Remote desktop connection (mstsc.exe) works only with DNS names, when using real server IP's it does not work.

Improve this answer
0

In this link I Find the solution

https://blog.getcryptostopper.com/rdp-brute-force-attack-detection-and-blacklisting-with-powershell

Desktop>>Properties>>Remote Access >> Authentication (uncheck NLA)

Improve this answer
1
  • So there is no way to have NLA on and NTLM off? Super lame Microsoft...
    – jjxtra
    Jun 29, 2020 at 16:55
0

There is no way to have NLA on and NTLM disabled. I've tested this on Windows server 2012 and 2016. I've tried all the standard group policy changes with setting cred ssp oracle remediation to vulnerable, but it has no effect.

If you want NTLM disabled in group policy, you must disable NLA.

If anyone has found a way to keep NLA on and NTLM disabled in group policy I would love to hear about it, but so far no where on the Internet have I found instructions to do this successfully.

Improve this answer
0

You can add exceptions using group policy. You can exclude servers using their FQDN or IP

enter image description here

Improve this answer
1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Oct 20, 2021 at 17:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .