Microsoft-Windows-NTLM

Message #

NTLM authentication failed because the account was a member of the Protected User group.

Account Name: %1
Device Name: %2
Error Code: %3

Fields #

Message #

NTLM authentication failed because access control restrictions are required.

Account Name: %1
Device Name: %2
Error Code: %3

Authentication Policy Information:
	Silo Name: %4
	PolicyName: %5

Fields #

Message #

NTLM authentication succeded, but it will fail when Authentication Policy is enforced because access control restrictions are required.

Account Name: %1
Device Name: %2
Error Code: %3

Authentication Policy Information:
	Silo Name: %4
	PolicyName: %5

Fields #

Message #

NTLM client blocked: Outgoing NTLM authentication traffic to remote servers that is blocked.
Target server: %1
Supplied user: %2
Supplied domain: %3
PID of client process: %4
Name of client process: %5
LUID of client process: %6
User identity of client process: %7
Domain name of user identity of client process: %8
Mechanism OID: %9

NTLM authentication requests from this computer are blocked.

If you want to allow this computer to use NTLM authentication, set the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Allow all.

If you want only the target server %1 to accept NTLM authentication requests from this computer, set the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all and then set the security policy Network Security: Restrict NTLM: Add remote server exceptions and list the target server %1 as an exception to use NTLM authentication.

Fields #

Message #

NTLM server blocked: Incoming NTLM traffic to servers that is blocked
Calling process PID: %1
Calling process name: %2
Calling process LUID: %3
Calling process user identity: %4
Calling process domain identity: %5
Mechanism OID: %6

NTLM authentication requests to this server have been blocked.

If you want this server to allow NTLM authentication, set the security policy Network Security: Restrict NTLM: Incoming NTLM Traffic to Allow all.

Fields #

Message #

NTLM server blocked in the domain: NTLM authentication in this domain that is blocked
User: %1
Domain: %2
Workstation: %3
PID: %4
Process: %5
Logon type: %6
InProc: %7
Mechanism: %8

NTLM authentication within the domain %2 is blocked.

If you want to allow NTLM authentication requests in the domain %1, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests only to specific servers in the domain %1, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain as an exception to use NTLM authentication.

Fields #

Message #

NTLM Minimum Client Security Block:
Calling process PID: %1
Calling Process Name: %2
Negotiated Security Flags: %3
Minimum Security Flags: %4

Fields #

Message #

NTLM Minimum Server Security Block:
Calling process PID: %1
Calling Process Name: %2
Negotiated Security Flags: %3
Minimum Security Flags: %4

Fields #

Message #

NTLM client used the domain password. The attempt to use the DC-generated NTLM secret failed, and fallback to the domain password succeeded.
Account Name: %1
Device Name: %2

Fields #

Message #

Attempt to use NTLMv1 failed.

Target server: %1
Supplied user: %2
Supplied domain: %3
PID of client process: %4
Name of client process: %5
LUID of client process: %6
User identity of client process: %7
Domain name of user identity of client process: %8
Mechanism OID: %9

This device does not support NTLMv1. For more information, see https://go.microsoft.com/fwlink/?linkid=856826.

Fields #

Message #

Attempt to get credential key by call package blocked by Credential Guard.

Calling Process Name: %1
Service Host Tag: %2

Fields #

Message #

NTLM client blocked: Outgoing NTLM authentication traffic to remote servers that is blocked.
Target server: %1
Supplied user: %2
Supplied domain: %3
PID of client process: %4
Name of client process: %5
LUID of client process: %6
User identity of client process: %7
Domain name of user identity of client process: %8
Mechanism OID: %9

An application on this computer attempted NTLM for authentication but the application explicitly blocks NTLM usage. Using an IP address or local user credentials from a remote computer may lead to an NTLM authentication attempt. This event does not mean that NTLM is blocked for all authentication attempts from this computer.

Fields #

Message #

This machine attempted to authenticate to a remote resource via NTLM.

Process Information:
	Process Name: %1
	Process PID: %2

Client Information:
	Username: %3
	Domain: %4
	Hostname: %5 
	Sign-On Type: %6

Target Information:
	Target Machine: %7
	Target Domain: %8
	Target Resource: %9
	Target IP: %10
	Target Network Name: %11

NTLM Usage:
	Reason ID: %12
	Reason: %13

NTLM Security:
	Negotiated Flags: %14
	NTLM Version: %15
	Session Key Status: %16
	Channel Binding: %17
	Service Binding: %18
	MIC Status: %19
	AvFlags: %20
	AvFlags String: %21

For more information, see aka.ms/ntlmlogandblock

Fields #

Message #

This machine attempted to authenticate to a remote resource via NTLM.

Process Information:
	Process Name: %1
	Process PID: %2

Client Information:
	Username: %3
	Domain: %4
	Hostname: %5 
	Sign-On Type: %6

Target Information:
	Target Machine: %7
	Target Domain: %8
	Target Resource: %9
	Target IP: %10
	Target Network Name: %11

NTLM Usage:
	Reason ID: %12
	Reason: %13

NTLM Security:
	Negotiated Flags: %14
	NTLM Version: %15
	Session Key Status: %16
	Channel Binding: %17
	Service Binding: %18
	MIC Status: %19
	AvFlags: %20
	AvFlags String: %21

For more information, see aka.ms/ntlmlogandblock

Fields #

Message #

A remote client is using NTLM to authenticate to this workstation.

Process Information:
	Process Name: %1
	Process PID: %2

Remote Client Information:
	Username: %3
	Domain: %4
	Client Machine: %5
	Client IP: %6
	Client Network Name: %7

NTLM Security:
	Negotiated Flags: %8
	NTLM Version: %9
	Session Key Status: %10
	Channel Binding: %11
	Service Binding: %12
	Target Machine: %13
	Target Domain: %14
	MIC Status: %15
	AvlFlags: %16
	AvlFlags String: %17

Status: %18
Status Message: %19

For more information, see aka.ms/ntlmlogandblock

Fields #

Message #

A remote client is using NTLM to authenticate to this workstation.

Process Information:
	Process Name: %1
	Process PID: %2

Remote Client Information:
	Username: %3
	Domain: %4
	Client Machine: %5
	Client IP: %6
	Client Network Name: %7

NTLM Security:
	Negotiated Flags: %8
	NTLM Version: %9
	Session Key Status: %10
	Channel Binding: %11
	Service Binding: %12
	Target Machine: %13
	Target Domain: %14
	MIC Status: %15
	AvlFlags: %16
	AvlFlags String: %17

Status: %18
Status Message: %19

For more information, see aka.ms/ntlmlogandblock

Fields #

Message #

Auditing an attempt to use NTLMv1-derived credentials for Single Sign-On. 

Target server: %1
Supplied user: %2
Supplied domain: %3
PID of client process: %4
Name of client process: %5
LUID of client process: %6
User identity of client process: %7
Domain name of user identity of client process: %8
Mechanism OID: %9

For more information, see https://go.microsoft.com/fwlink/?linkid=2321802.

Fields #

Message #

An attempt to use NTLMv1-derived credentials for Single Sign-On was blocked due to policy.

Target server: %1
Supplied user: %2
Supplied domain: %3
PID of client process: %4
Name of client process: %5
LUID of client process: %6
User identity of client process: %7
Domain name of user identity of client process: %8
Mechanism OID: %9

For more information, see https://go.microsoft.com/fwlink/?linkid=2321802.

Fields #

Message #

NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked.
Target server: %1
Supplied user: %2
Supplied domain: %3
PID of client process: %4
Name of client process: %5
LUID of client process: %6
User identity of client process: %7
Domain name of user identity of client process: %8
Mechanism OID: %9

Audit the NTLM authentication requests from this computer that would be blocked by the target server %1 if the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers is set to Deny all.

If you want all servers to accept NTLM authentication requests from this computer, set the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Allow all.

If you want only the target server %1 to accept NTLM authentication requests from this computer, set the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all, and then set the security policy Network Security: Restrict NTLM: Add remote server exceptions and list the target server %1 as an exception to use NTLM authentication.

Fields #

References #

• Microsoft Learn

Message #

NTLM server blocked audit: Audit Incoming NTLM Traffic that would be blocked
Calling process PID: %1
Calling process name: %2
Calling process LUID: %3
Calling process user identity: %4
Calling process domain identity: %5
Mechanism OID: %6

Audit NTLM authentication requests to this server that would be blocked if the security policy Network Security: Restrict NTLM: Incoming NTLM Traffic is set to Deny all accounts or Deny all domain accounts.

If you want this server to allow NTLM authentication, set the security policy Network Security: Restrict NTLM: Incoming NTLM Traffic to Allow all.

Fields #

References #

• Microsoft Learn

Message #

NTLM server blocked in the domain audit: Audit NTLM authentication in this domain
User: %1
Domain: %2
Workstation: %3
PID: %4
Process: %5
Logon type: %6
InProc: %7
Mechanism: %8

Audit NTLM authentication requests within this domain that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to Deny for domain servers or Deny domain accounts to domain servers.

If you want to allow NTLM authentication requests in the domain %1, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests to specific servers in the domain %1, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain to use NTLM authentication.

Fields #

Community Notes #

Appearing prior to 4624/4776 may indicate unsuccessful coercion probes.

References #

• Microsoft Learn

Fields #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Community Notes #

Aggregated by the Splunk ESCU 'Windows Unusual NTLM Authentication' analytics (by source, user, and destination) and matched by the SigmaHQ 'NTLM Brute Force' rule on WorkstationName. This is a down-level DC event: it is absent from the Microsoft-Windows-NTLM provider manifest on Windows Server 2022 and Windows 11, where the equivalent domain-audit event is 8003.

References #

• Microsoft Learn

Fields #

Community Notes #

Companion to event 8004 in the domain-controller NTLM-audit family (8004 to 8006). Consumed together by the Splunk ESCU 'Windows Multiple NTLM Null Domain Authentications' analytic (EventCode IN 8004,8005,8006). Down-level events: absent from the Microsoft-Windows-NTLM provider manifest on Windows Server 2022 and Windows 11, where the domain-audit event is 8003. Per-id field detail is thinly documented; the shared family fields are the secure channel, account, and workstation.

References #

• Microsoft Learn
• Microsoft: Enriched NTLM authentication data (Event 8004)

Fields #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Community Notes #

Companion to event 8004 in the domain-controller NTLM-audit family (8004 to 8006). Consumed together by the Splunk ESCU 'Windows Multiple NTLM Null Domain Authentications' analytic (EventCode IN 8004,8005,8006). Down-level events: absent from the Microsoft-Windows-NTLM provider manifest on Windows Server 2022 and Windows 11, where the domain-audit event is 8003. Per-id field detail is thinly documented; the shared family fields are the secure channel, account, and workstation.

References #

• Microsoft Learn
• Microsoft: Enriched NTLM authentication data (Event 8004)