TMA-WIN-LMCOMPAT
Ensure LAN Manager authentication level is NTLMv2 only (refuse LM and NTLM)
HighLevel 1Automatedwindows
Description
LmCompatibilityLevel should be 5. Verify no legacy device still uses NTLMv1 before enforcing.
How it is checked
Audit method: Shell command
shell
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa').LmCompatibilityLevel- Expected output
5
How it is fixed
Fix method: Shell command
shell
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name LmCompatibilityLevel -Value 5 -Type DWordProperties
- Operating systems
- Any
- Tags
- windowsntlm
- Reference
- CIS Microsoft Windows Server Benchmark - Security Options / Network security: LAN Manager authentication level
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target windows