How can I control which authentication methods my Active Directory (AD) domain supports?

A. By default, an AD domain supports LAN Manager, NT LAN Manager (NTLM), NTLMv2, and Kerberos, although it will always attempt to use the most secure shared authentication method. For example, a Windows NT 4.0 Service Pack 6 (SP6) machine will use NTLMv2 when talking to an AD domain controller (DC) because, although AD understands Kerberos, the client supports only NTLMv2 at best.

To restrict the protocols that DCs and clients support, you can modify the Network Security LAN Manager Authentication Level policy by performing these steps:

When the policy refreshes, the level of LAN Manager and NTLM support will change for the clients and servers to which you applied the policy. Table 1 shows the various policy options and their effects. Note that the policy affects clients and DCs in different ways.

If your environment consists of only Windows 2000 and later machines, you should configure the "Send NTLMv2 response onlyrefuse LM & NTLM" option, which will allow only NTLMv2 authentication (although Kerberos will still be the preferred authentication method).