There is a right order for this job and Microsoft published it: see who uses NTLM, remove the reasons, then switch it off. Offices that skip to step three spend the following week switching it back on. Here is the order, applied to a real network.
On 29 January 2026 Microsoft published its three-phase plan for ending NTLM. Phase 1, available now, is enhanced NTLM auditing in Windows Server 2025 and Windows 11 version 24H2 and later. Phase 2, announced for the second half of 2026, adds IAKerb and a local Key Distribution Center to remove the most common reasons NTLM is still needed. Phase 3, with the next major Windows Server release, disables network NTLM by default - announced, not yet shipped, but the direction is fixed. Your network should walk the same three steps in miniature, at your own pace, instead of being dragged by an update. Here is how.
The three-step order. Each step earns the right to take the next one.
Deploy the three Restrict NTLM audit policies (the full method has its own page in this series): audit NTLM authentication in this domain, audit incoming NTLM traffic, and audit outgoing NTLM traffic. Read events 8001 to 8004 in the NTLM Operational log and the Package Name field of Security log event 4624.
Nearly every audit entry has one of four reasons, and each has a fix that is better than an exception:
For that last pile, use Network security: Restrict NTLM: Add server exceptions in this domain to name the specific servers involved. Exceptions written by name, for a reason, with a review date - not a blanket allow.
setspn for the service account involvedOnly when the audit log has gone quiet for normal traffic do you change the Restrict NTLM policies from Audit to their Deny settings - and even then, in stages: one OU or one server group first, watched for a week, then the next. Keep auditing switched on permanently after enforcement. The log is now your tripwire: a new event means a new device, a changed application or a forgotten corner - and you will see it before users report it.
Agree the rollback before you start: the policy change that enforces can be reversed in minutes. Announce that to yourself and your team in advance. A migration with a known rollback is a calm job; one without is a gamble.
The full process with live demonstration - every setting shown on screen, step by step.
Watch Full VideoPhase 1 is enhanced NTLM auditing, available now in Windows Server 2025 and Windows 11 24H2 and later. Phase 2, announced for the second half of 2026, adds IAKerb and a local KDC to remove common reasons for falling back to NTLM. Phase 3 disables network NTLM by default with the next major Windows Server release - announced, not yet shipped.
Name it in the server exceptions policy (Restrict NTLM: Add server exceptions in this domain), scoped to that server only, and record why. A short named exception list is good administration; an unexamined blanket allow is not.
Yes - the Deny settings are Group Policy values. Change them back to Audit and refresh policy, and NTLM flows again while you investigate. Decide this rollback before enforcing so nobody improvises under pressure.