You cannot fix what you cannot see. Windows can tell you exactly which accounts, machines and devices still authenticate with NTLM - you only have to switch the auditing on first. Here is how to turn the lights on and read what they show.
Every NTLM migration that fails, fails the same way: somebody blocks NTLM first and discovers afterwards that a scanner, an old application or a forgotten server needed it. Audit mode exists so you never have to guess. In audit mode nothing is blocked - Windows simply writes a log entry every time NTLM is used. On Windows 11 version 24H2 and Windows Server 2025, Microsoft has even shipped enhanced NTLM auditing as phase 1 of its phase-out plan, with richer detail about who used NTLM, why it was chosen, and from where. Here is the complete method.
The four NTLM audit events you will see in the Operational log once auditing is enabled. Event layout shown as an example.
NTLM auditing is controlled by three Group Policy settings, all under Computer Configuration - Windows Settings - Security Settings - Local Policies - Security Options:
Link the policy to the domain controllers' OU for the first setting, and to your server and workstation OUs for the other two. Then run gpupdate /force or simply wait for the next policy refresh.
Open Event Viewer and go to Applications and Services Logs - Microsoft - Windows - NTLM - Operational. Each event names the account, the target server and the machine involved:
You can pull the log from many machines at once with one command: Get-WinEvent -LogName Microsoft-Windows-NTLM/Operational.
The Security log gives you a second, independent view. In every successful logon event 4624, look at the Detailed Authentication Information section:
Filter a domain controller's Security log for 4624 events where the package is NTLM, and you have a complete list of NTLM logons that DC handled - including the NTLMv1 ones that are your highest priority, because NTLMv1 is the flavour already being removed.
A weekend of logs is not an audit. Month-end applications, quarterly reports, backup agents and that one scanner used only for audits all authenticate rarely. Run auditing for at least one full business cycle - a month is a sensible minimum - before you conclude anything is unused.
Then sort the findings into three piles: things that can move to Kerberos (most Windows-to-Windows traffic), things that need a firmware or settings change, and genuine legacy that needs an exception or an isolation plan. Each pile has its own page in this series.
The full process with live demonstration - every setting shown on screen, step by step.
Watch Full VideoIn Event Viewer under Applications and Services Logs - Microsoft - Windows - NTLM - Operational. Events 8001 to 8004 cover outgoing, incoming, in-domain and pass-through NTLM authentication once the Restrict NTLM audit policies are enabled.
No. Audit mode only records. Blocking starts only when you change the matching Restrict NTLM policies from Audit to Deny, which is a separate, deliberate step you take later.
At least one full business cycle - a month is a practical minimum - so that monthly and quarterly jobs, backup agents and rarely used devices all get a chance to appear in the log.