Q: How can I find out if my clients are using NTLM for authentication instead of Kerberos against specific Windows servers, applications, or services?

A:Windows 7 and Windows Server 2008 R2 include new Group Policy settings that let you audit, analyze, and restrict NTLM authentication use in yourWindows environment. Microsoft introduced three security policy settings you can use for auditing NTLM traffic. The settings are stored in thefollowing Group Policy Object (GPO) container: Computer ConfigurationPoliciesWindows SettingsSecurity SettingsLocal PoliciesSecurity Options.They're called:

You should enable the Restrict NTLM: Audit NTLM authentication in this domain setting only on your Windows Server 2008 R2 domain controllers(DCs). To enable it, choose the Enable all option in the Microsoft Management Console (MMC) GPO Editor snap-in.

You can use the other two settings -- Restrict NTLM: Outgoing NTLM traffic to remote servers andRestrict NTLM: Audit Incoming NTLM Traffic -- for auditing NTLM authentication traffic on all Windows 7 and Windows Server 2008 R2 computers.To enable auditing for the first setting, choose the Audit all option, as Figure 1 shows; to enable auditing for the latter setting, choosethe Enable auditing for all accounts option.
Figure 1: Enabling the Restrict NTLM: Outgoing NTLM traffic to remote servers setting

NTLM audit events are written to the following event log path: Applications and Services LogsMicrosoftWindowsNTLMOperational. Note that this logisn't visible by default in the MMC Event Viewer snap-in. To view this log, you must enable the Show Analytic and Debug Logs option in theEvent Viewer's View menu.

Whenever the NTLM protocol is used for authentication, an event with ID 8004 shows up in a Windows Server 2008 R2 DC's log, an event with ID 8003 showsup in a Windows Server 2008 R2 member server's log, and an event with ID 8001 appears in a Windows 7 client's log, as Figure 2 illustrates
Figure 2: Event ID 8001, indicating NTLM protocol authentication, appearing in a Windows 7 client log (Click image for larger view)